MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity
cti-python-stix2/docs/guide/markings.ipynb

1543 lines
83 KiB
Plaintext
Raw Normal View History

Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
{
"cells": [
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 6,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {
Include IPython notebooks in Sphinx docs Note: The first cell in each .ipynb file contains code to suppress tracebacks in output cells. Thus cells that generate exceptions will only output the error, without the traceback, which makes the documentation easier to read.
2017-09-18 19:29:14 +02:00
"nbsphinx": "hidden"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
},
"outputs": [],
"source": [
"# Delete this cell to re-enable tracebacks\n",
"import sys\n",
"ipython = get_ipython()\n",
"\n",
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
" exception_only=False, running_compiled_code=False):\n",
" etype, value, tb = sys.exc_info()\n",
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
"\n",
"ipython.showtraceback = hide_traceback"
]
},
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 5,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {
"nbsphinx": "hidden"
},
"outputs": [],
"source": [
"# JSON output syntax highlighting\n",
"from __future__ import print_function\n",
"from pygments import highlight\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"from pygments.lexers import JsonLexer, TextLexer\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"from pygments.formatters import HtmlFormatter\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"from IPython.display import display, HTML\n",
"from IPython.core.interactiveshell import InteractiveShell\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"InteractiveShell.ast_node_interactivity = \"all\"\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"\n",
"def json_print(inpt):\n",
" string = str(inpt)\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" formatter = HtmlFormatter()\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" if string[0] == '{':\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" lexer = JsonLexer()\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" else:\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" lexer = TextLexer()\n",
" return HTML('<style type=\"text/css\">{}</style>{}'.format(\n",
" formatter.get_style_defs('.highlight'),\n",
" highlight(string, lexer, formatter)))\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"globals()['print'] = json_print"
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
]
},
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
{
"cell_type": "markdown",
"metadata": {},
"source": [
"## Data Markings"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Creating Objects With Data Markings\n",
"\n",
"To create an object with a (predefined) TLP marking to an object, just provide it as a keyword argument to the constructor. The TLP markings can easily be imported from python-stix2."
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 7,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
Fix redundant Data Markings example To show both uses of get_markings()
2017-11-13 15:44:00 +01:00
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924708Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;marking-definition--f88d31f6-486f-44da-b317-01333bde0b82&quot;</span>\n",
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 7,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"from stix2 import Indicator, TLP_AMBER\n",
"\n",
"indicator = Indicator(labels=[\"malicious-activity\"],\n",
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" object_marking_refs=TLP_AMBER)\n",
"print(indicator)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"If you’re creating your own marking (for example, a ``Statement`` marking), first create the statement marking:"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 8,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;marking-definition&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:53.98008Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;definition_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;statement&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;definition&quot;</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;statement&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Copyright 2017, Example Corp&quot;</span>\n",
" <span class=\"p\">}</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 8,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"from stix2 import MarkingDefinition, StatementMarking\n",
"\n",
"marking_definition = MarkingDefinition( \n",
" definition_type=\"statement\", \n",
" definition=StatementMarking(statement=\"Copyright 2017, Example Corp\")\n",
")\n",
"print(marking_definition)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Then you can add it to an object as it’s being created (passing either full object or the the ID as a keyword argument, like with relationships)."
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 9,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--7caeab49-2472-41bb-a988-2f990aea99bd&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:55.763Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:55.763Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:55.763364Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"s2\">&quot;marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 9,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"indicator2 = Indicator(labels=[\"malicious-activity\"],\n",
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" object_marking_refs=marking_definition)\n",
"print(indicator2)"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 10,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--4eb21bbe-b8a9-4348-86cf-1ed52f9abdd7&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:57.248Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:57.248Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:57.248658Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;marking-definition--f88d31f6-486f-44da-b317-01333bde0b82&quot;</span>\n",
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 10,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"indicator3 = Indicator(labels=[\"malicious-activity\"],\n",
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" object_marking_refs=\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\")\n",
"print(indicator3)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Granular markings work in the same way, except you also need to provide a full granular-marking object (including the selector)."
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 11,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--ef1eddbb-b5a5-47e0-b607-75b9870d8d91&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:59.103Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:59.103Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Poison Ivy&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;description&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;A ransomware related to ...&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;remote-access-trojan&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;granular_markings&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"p\">{</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;marking_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;selectors&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;description&quot;</span>\n",
" <span class=\"p\">]</span>\n",
" <span class=\"p\">},</span>\n",
" <span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;marking_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;selectors&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;name&quot;</span>\n",
" <span class=\"p\">]</span>\n",
" <span class=\"p\">}</span>\n",
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 11,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"from stix2 import Malware, TLP_WHITE\n",
"\n",
"malware = Malware(name=\"Poison Ivy\",\n",
" labels=['remote-access-trojan'],\n",
" description=\"A ransomware related to ...\",\n",
" granular_markings=[\n",
" {\n",
" \"selectors\": [\"description\"],\n",
" \"marking_ref\": marking_definition\n",
" },\n",
" {\n",
" \"selectors\": [\"name\"],\n",
" \"marking_ref\": TLP_WHITE\n",
" }\n",
" ])\n",
"print(malware)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Make sure that the selector is a field that exists and is populated on the object, otherwise this will cause an error:"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 12,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
"ename": "InvalidSelectorError",
"evalue": "Selector title in Malware is not valid!",
"output_type": "error",
"traceback": [
"\u001b[0;31mInvalidSelectorError\u001b[0m\u001b[0;31m:\u001b[0m Selector title in Malware is not valid!\n"
]
}
],
"source": [
"Malware(name=\"Poison Ivy\",\n",
" labels=['remote-access-trojan'],\n",
" description=\"A ransomware related to ...\",\n",
" granular_markings=[\n",
" {\n",
" \"selectors\": [\"title\"],\n",
" \"marking_ref\": marking_definition\n",
" }\n",
" ])"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Adding Data Markings To Existing Objects"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Add inter-documentation links So when users read the guide docs, they can click a link to go to a relevant section in the API reference.
2017-11-09 21:42:59 +01:00
"[Several functions](../api/stix2.markings.rst) exist to support working with data markings.\n",
"\n",
"Both object markings and granular markings can be added to STIX objects which have already been created.\n",
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"\n",
"**Note**: Doing so will create a new version of the object (note the updated ``modified`` time)."
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 13,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:50:03.387Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924708Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"s2\">&quot;marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"s2\">&quot;marking-definition--f88d31f6-486f-44da-b317-01333bde0b82&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 13,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator4 = indicator.add_markings(marking_definition)\n",
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"print(indicator4)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"You can also remove specific markings from STIX objects. This will also create a new version of the object."
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 14,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:50:05.109Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924708Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;marking-definition--f88d31f6-486f-44da-b317-01333bde0b82&quot;</span>\n",
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 14,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator5 = indicator4.remove_markings(marking_definition)\n",
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"print(indicator5)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"The markings on an object can be replaced with a different set of markings:"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 15,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:50:06.773Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924708Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;object_marking_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"s2\">&quot;marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"s2\">&quot;marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 15,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
"from stix2 import TLP_GREEN\n",
"\n",
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator6 = indicator5.set_markings([TLP_GREEN, marking_definition])\n",
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"print(indicator6)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Add inter-documentation links So when users read the guide docs, they can click a link to go to a relevant section in the API reference.
2017-11-09 21:42:59 +01:00
"STIX objects can also be cleared of all markings with [clear_markings()](../api/stix2.markings.rst#stix2.markings.clear_markings):"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 16,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:50:08.616Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2018-04-05T19:49:47.924708Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;labels&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"s2\">&quot;malicious-activity&quot;</span>\n",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
" <span class=\"p\">]</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 16,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator7 = indicator5.clear_markings()\n",
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"print(indicator7)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"All of these functions can be used for granular markings by passing in a list of selectors. Note that they will create new versions of the objects."
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Evaluating Data Markings\n",
"\n",
"You can get a list of the object markings on a STIX object:"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 17,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"['marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368',\n",
" 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 17,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator6.get_markings()"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Add inter-documentation links So when users read the guide docs, they can click a link to go to a relevant section in the API reference.
2017-11-09 21:42:59 +01:00
"To get a list of the granular markings on an object, pass the object and a list of selectors to [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings):"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 18,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
"['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 18,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
Fix redundant Data Markings example To show both uses of get_markings()
2017-11-13 15:44:00 +01:00
"from stix2 import get_markings\n",
"\n",
"get_markings(malware, 'name')"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Add inter-documentation links So when users read the guide docs, they can click a link to go to a relevant section in the API reference.
2017-11-09 21:42:59 +01:00
"You can also call [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings) as a method on the STIX object."
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 19,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 19,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"malware.get_markings('name')"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Finally, you may also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors."
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 20,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
"True"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 20,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"indicator.is_marked(TLP_AMBER.id)"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 21,
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
"True"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 21,
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"malware.is_marked(TLP_WHITE.id, 'name')"
]
},
{
"cell_type": "code",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 22,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {
"scrolled": true
},
"outputs": [
{
"data": {
"text/plain": [
"False"
]
},
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"execution_count": 22,
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
Update markings docs with latest update
2017-10-04 17:05:33 +02:00
"malware.is_marked(TLP_WHITE.id, 'description')"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
]
update user guide on marking extraction via API
2019-05-03 20:48:16 +02:00
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
marking-definition
2019-05-03 21:41:58 +02:00
"# Extracting Lang Data Markings or marking-definition Data Markings\n",
update user guide on marking extraction via API
2019-05-03 20:48:16 +02:00
"\n",
"If you need a specific kind of marking, you can also filter them using the API. By default the library will get both types of markings by default. You can choose between `lang=True/False` or `marking_ref=True/False` depending on your use-case."
]
},
{
"cell_type": "code",
"execution_count": 16,
"metadata": {},
"outputs": [
{
"name": "stdout",
"output_type": "stream",
"text": [
"{\n",
" \"type\": \"indicator\",\n",
" \"spec_version\": \"2.1\",\n",
" \"id\": \"indicator--634ef462-d6b5-48bc-9d9f-b46a6919227c\",\n",
" \"created\": \"2019-05-03T18:36:44.354Z\",\n",
" \"modified\": \"2019-05-03T18:36:44.354Z\",\n",
" \"description\": \"Una descripcion sobre este indicador\",\n",
" \"indicator_types\": [\n",
" \"malware\"\n",
" ],\n",
" \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" \"valid_from\": \"2019-05-03T18:36:44.354443Z\",\n",
" \"object_marking_refs\": [\n",
" \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
" ],\n",
" \"granular_markings\": [\n",
" {\n",
" \"lang\": \"es\",\n",
" \"selectors\": [\n",
" \"description\"\n",
" ]\n",
" },\n",
" {\n",
" \"marking_ref\": \"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\",\n",
" \"selectors\": [\n",
" \"description\"\n",
" ]\n",
" }\n",
" ]\n",
"}\n",
"['es', 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']\n",
"['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']\n",
"['es']\n"
]
}
],
"source": [
"from stix2 import v21\n",
"\n",
"v21_indicator = v21.Indicator(\n",
" description=\"Una descripcion sobre este indicador\",\n",
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" object_marking_refs=['marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'],\n",
" indicator_types=['malware'],\n",
" granular_markings=[\n",
" {\n",
" 'selectors': ['description'],\n",
" 'lang': 'es'\n",
" },\n",
" {\n",
" 'selectors': ['description'],\n",
" 'marking_ref': 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da'\n",
" }\n",
" ]\n",
")\n",
"print(v21_indicator)\n",
marking-definition
2019-05-03 21:41:58 +02:00
"\n",
"# Gets both lang and marking_ref markings for 'description'\n",
"print(v21_indicator.get_markings('description'))\n",
"\n",
"# Exclude lang markings from results\n",
"print(v21_indicator.get_markings('description', lang=False))\n",
"\n",
"# Exclude marking-definition markings from results\n",
"print(v21_indicator.get_markings('description', marking_ref=False))"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"In this same manner, calls to `clear_markings` and `set_markings` also have the ability to operate in for one or both types of markings."
]
},
{
"cell_type": "code",
"execution_count": 5,
"metadata": {},
"outputs": [
{
"name": "stdout",
"output_type": "stream",
"text": [
"{\n",
" \"type\": \"indicator\",\n",
" \"spec_version\": \"2.1\",\n",
" \"id\": \"indicator--a612665a-2df4-4fd2-851c-7fbb8c92339a\",\n",
" \"created\": \"2019-05-03T19:13:59.010Z\",\n",
" \"modified\": \"2019-05-03T19:15:41.173Z\",\n",
" \"description\": \"Una descripcion sobre este indicador\",\n",
" \"indicator_types\": [\n",
" \"malware\"\n",
" ],\n",
" \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" \"valid_from\": \"2019-05-03T19:13:59.010624Z\",\n",
" \"object_marking_refs\": [\n",
" \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
" ]\n",
"}\n"
]
}
],
"source": [
"print(v21_indicator.clear_markings(\"description\")) # By default, both types of markings will be removed"
]
},
{
"cell_type": "code",
"execution_count": 13,
"metadata": {},
"outputs": [
{
"name": "stdout",
"output_type": "stream",
"text": [
"{\n",
" \"type\": \"indicator\",\n",
" \"spec_version\": \"2.1\",\n",
" \"id\": \"indicator--982aeb4d-4dd3-4b04-aa50-a1d00c31986c\",\n",
" \"created\": \"2019-05-03T19:19:26.542Z\",\n",
" \"modified\": \"2019-05-03T19:20:51.818Z\",\n",
" \"description\": \"Una descripcion sobre este indicador\",\n",
" \"indicator_types\": [\n",
" \"malware\"\n",
" ],\n",
" \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" \"valid_from\": \"2019-05-03T19:19:26.542267Z\",\n",
" \"object_marking_refs\": [\n",
" \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
" ],\n",
" \"granular_markings\": [\n",
" {\n",
" \"lang\": \"es\",\n",
" \"selectors\": [\n",
" \"description\"\n",
" ]\n",
" }\n",
" ]\n",
"}\n"
]
}
],
"source": [
"# If lang is False, no lang markings will be removed\n",
"print(v21_indicator.clear_markings(\"description\", lang=False))"
]
},
{
"cell_type": "code",
"execution_count": 2,
"metadata": {},
"outputs": [
{
"name": "stdout",
"output_type": "stream",
"text": [
"{\n",
" \"type\": \"indicator\",\n",
" \"spec_version\": \"2.1\",\n",
" \"id\": \"indicator--de0316d6-38e1-43c2-af4f-649305251864\",\n",
" \"created\": \"2019-05-03T19:40:21.459Z\",\n",
" \"modified\": \"2019-05-03T19:40:26.431Z\",\n",
" \"description\": \"Una descripcion sobre este indicador\",\n",
" \"indicator_types\": [\n",
" \"malware\"\n",
" ],\n",
" \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" \"valid_from\": \"2019-05-03T19:40:21.459582Z\",\n",
" \"object_marking_refs\": [\n",
" \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
" ],\n",
" \"granular_markings\": [\n",
" {\n",
" \"marking_ref\": \"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\",\n",
" \"selectors\": [\n",
" \"description\"\n",
" ]\n",
" }\n",
" ]\n",
"}\n"
]
}
],
"source": [
"# If marking_ref is False, no marking-definition markings will be removed\n",
"print(v21_indicator.clear_markings(\"description\", marking_ref=False))"
update user guide on marking extraction via API
2019-05-03 20:48:16 +02:00
]
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
],
"metadata": {
"kernelspec": {
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"display_name": "Python 3",
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
"language": "python",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"name": "python3"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
},
"language_info": {
"codemirror_mode": {
"name": "ipython",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"version": 3
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
},
"file_extension": ".py",
"mimetype": "text/x-python",
"name": "python",
"nbconvert_exporter": "python",
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"pygments_lexer": "ipython3",
"version": "3.6.3"
Add Data Markings documentation (Jupyter)
2017-09-15 19:14:54 +02:00
}
},
"nbformat": 4,
"nbformat_minor": 2
}