MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity
cti-python-stix2/docs/guide/creating.ipynb

1140 lines
64 KiB
Plaintext
Raw Normal View History

Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
{
"cells": [
{
"cell_type": "code",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"execution_count": 1,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {
Include IPython notebooks in Sphinx docs Note: The first cell in each .ipynb file contains code to suppress tracebacks in output cells. Thus cells that generate exceptions will only output the error, without the traceback, which makes the documentation easier to read.
2017-09-18 19:29:14 +02:00
"nbsphinx": "hidden"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
},
"outputs": [],
"source": [
"# Delete this cell to re-enable tracebacks\n",
"import sys\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"import traceback\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"ipython = get_ipython()\n",
"\n",
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
" exception_only=False, running_compiled_code=False):\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" etype, value, tb = sys.exc_info() \n",
" value.__cause__ = None # suppress chained exceptions\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
"\n",
"ipython.showtraceback = hide_traceback"
]
},
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
{
"cell_type": "code",
"execution_count": 2,
"metadata": {
"nbsphinx": "hidden"
},
"outputs": [],
"source": [
"# JSON output syntax highlighting\n",
"from __future__ import print_function\n",
"from pygments import highlight\n",
"from pygments.lexers import JsonLexer\n",
"from pygments.formatters import HtmlFormatter\n",
"from IPython.display import HTML\n",
"\n",
"original_print = print\n",
"\n",
"def json_print(inpt):\n",
" string = str(inpt)\n",
" if string[0] == '{':\n",
" formatter = HtmlFormatter()\n",
" return HTML('<style type=\"text/css\">{}</style>{}'.format(\n",
" formatter.get_style_defs('.highlight'),\n",
" highlight(string, JsonLexer(), formatter)))\n",
" else:\n",
" original_print(inpt)\n",
"\n",
"print = json_print"
]
},
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
{
"cell_type": "markdown",
"metadata": {},
"source": [
"## Creating STIX Content"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Creating STIX Domain Objects\n",
"\n",
"To create a STIX object, provide keyword arguments to the type's constructor:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 15,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a862ff86-68d9-42e5-8095-cd80c040e112&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;File hash for malware variant&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 15,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"source": [
"from stix2 import Indicator\n",
"\n",
"indicator = Indicator(name=\"File hash for malware variant\",\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
" pattern_type=\"stix\")\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"print(indicator)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Certain required attributes of all objects will be set automatically if not provided as keyword arguments:\n",
"\n",
"- If not provided, ``type`` will be set automatically to the correct type. You can also provide the type explicitly, but this is not necessary:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 16,
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"metadata": {},
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"outputs": [],
"source": [
"indicator2 = Indicator(type='indicator',\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" pattern_type=\"stix\",\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Passing a value for ``type`` that does not match the class being constructed will cause an error:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 17,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"ename": "InvalidValueError",
"evalue": "Invalid value for Indicator 'type': must equal 'indicator'.",
"output_type": "error",
"traceback": [
"\u001b[0;31mInvalidValueError\u001b[0m\u001b[0;31m:\u001b[0m Invalid value for Indicator 'type': must equal 'indicator'.\n"
]
}
],
"source": [
"indicator3 = Indicator(type='xxx',\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" pattern_type=\"stix\",\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"- If not provided, ``id`` will be generated randomly. If you provide an\n",
" ``id`` argument, it must begin with the correct prefix:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 18,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"ename": "InvalidValueError",
"evalue": "Invalid value for Indicator 'id': must start with 'indicator--'.",
"output_type": "error",
"traceback": [
"\u001b[0;31mInvalidValueError\u001b[0m\u001b[0;31m:\u001b[0m Invalid value for Indicator 'id': must start with 'indicator--'.\n"
]
}
],
"source": [
"indicator4 = Indicator(id=\"campaign--63ce9068-b5ab-47fa-a2cf-a602ea01f21a\",\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" pattern_type=\"stix\",\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"For indicators, ``pattern`` and ``pattern_type`` are required and cannot be set automatically. Trying to create an indicator that is missing one of these properties will result in an error:"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 8,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"ename": "MissingPropertiesError",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"evalue": "No values for required properties for Indicator: (pattern, pattern_type).",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"output_type": "error",
"traceback": [
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"\u001b[0;31mMissingPropertiesError\u001b[0m\u001b[0;31m:\u001b[0m No values for required properties for Indicator: (pattern, pattern_type).\n"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
}
],
"source": [
"indicator = Indicator()"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"However, the required ``valid_from`` attribute on Indicators will be set to the current time if not provided as a keyword argument.\n",
"\n",
"Once created, the object acts like a frozen dictionary. Properties can be accessed using the standard Python dictionary syntax:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 9,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"'File hash for malware variant'"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 9,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"indicator['name']"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Or access properties using the standard Python attribute syntax:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 10,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
Ensure all guide doc output cells have [Out] label Fixes #105.
2018-04-05 22:44:44 +02:00
"'File hash for malware variant'"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 10,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"indicator.name"
]
},
Added a warning to creating.ipynb about Mapping attributes: they can't be used to access STIX object properties.
2020-01-29 22:01:15 +01:00
{
"cell_type": "markdown",
"metadata": {},
"source": [
Change the warning in the jupyter notebook for creating content, regarding name collisions between method and property names, to not pick on the Mapping methods specifically. The problem is more general than that: stix objects have more methods than those. Instead of listing them all out, a more general statement is made, that accessing those attributes will result in a bound method, not a STIX property value.
2020-02-03 22:51:12 +01:00
"<div class=\"alert alert-warning\">\n",
"\n",
"**Warning**\n",
"\n",
"Note that there are several attributes on these objects used for method names. Accessing those will return a bound method, not the attribute value.\n",
"\n",
"</div>\n"
Added a warning to creating.ipynb about Mapping attributes: they can't be used to access STIX object properties.
2020-01-29 22:01:15 +01:00
]
},
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Attempting to modify any attributes will raise an error:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 11,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"ename": "TypeError",
"evalue": "'Indicator' object does not support item assignment",
"output_type": "error",
"traceback": [
"\u001b[0;31mTypeError\u001b[0m\u001b[0;31m:\u001b[0m 'Indicator' object does not support item assignment\n"
]
}
],
"source": [
"indicator['name'] = \"This is a revised name\""
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 12,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
"ename": "ImmutableError",
"evalue": "Cannot modify 'name' property in 'Indicator' after creation.",
"output_type": "error",
"traceback": [
"\u001b[0;31mImmutableError\u001b[0m\u001b[0;31m:\u001b[0m Cannot modify 'name' property in 'Indicator' after creation.\n"
]
}
],
"source": [
"indicator.name = \"This is a revised name\""
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Clean up documentation
2018-04-09 19:29:53 +02:00
"To update the properties of an object, see the [Versioning](versioning.ipynb) section."
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"Creating a Malware object follows the same pattern:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 14,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--389c934c-258c-44fb-ae4b-14c6c12270f6&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T14:53:20.156644Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T14:53:20.156644Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Poison Ivy&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 14,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"source": [
"from stix2 import Malware\n",
"\n",
"malware = Malware(name=\"Poison Ivy\",\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" is_family=False)\n",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"print(malware)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"As with indicators, the ``type``, ``id``, ``created``, and ``modified`` properties will be set automatically if not provided. For Malware objects, the ``is_family`` property must be provided.\n",
Add inter-documentation links So when users read the guide docs, they can click a link to go to a relevant section in the API reference.
2017-11-09 21:42:59 +01:00
"\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"You can see the full list of SDO classes [here](../api/v21/stix2.v21.sdo.rst)."
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Creating Relationships\n",
"\n",
"STIX 2 Relationships are separate objects, not properties of the object on either side of the relationship. They are constructed similarly to other STIX objects. The ``type``, ``id``, ``created``, and ``modified`` properties are added automatically if not provided. Callers must provide the ``relationship_type``, ``source_ref``, and ``target_ref`` properties."
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 19,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--2f6a8785-e27b-487e-b870-b85a2121502d&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:18.250605Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:18.250605Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a862ff86-68d9-42e5-8095-cd80c040e112&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--389c934c-258c-44fb-ae4b-14c6c12270f6&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 19,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"source": [
"from stix2 import Relationship\n",
"\n",
"relationship = Relationship(relationship_type='indicates',\n",
" source_ref=indicator.id,\n",
" target_ref=malware.id)\n",
"print(relationship)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"The ``source_ref`` and ``target_ref`` properties can be either the ID's of other STIX objects, or the STIX objects themselves. For readability, Relationship objects can also be constructed with the ``source_ref``, ``relationship_type``, and ``target_ref`` as positional (non-keyword) arguments:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 20,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--d43ec245-5496-44f4-8732-3131380435de&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:47.705352Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:47.705352Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a862ff86-68d9-42e5-8095-cd80c040e112&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--389c934c-258c-44fb-ae4b-14c6c12270f6&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 20,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"source": [
"relationship2 = Relationship(indicator, 'indicates', malware)\n",
"print(relationship2)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Creating Bundles\n",
"\n",
"STIX Bundles can be created by passing objects as arguments to the Bundle constructor. All required properties (``type``, ``id``, and ``spec_version``) will be set automatically if not provided, or can be provided as keyword arguments:"
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 21,
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"metadata": {},
"outputs": [
{
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;bundle&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;bundle--177c6477-2dee-43d5-b4c9-8b7f3f5ec517&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;objects&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
" <span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a862ff86-68d9-42e5-8095-cd80c040e112&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;File hash for malware variant&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;[file:hashes.md5 = &#39;d41d8cd98f00b204e9800998ecf8427e&#39;]&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;pattern_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;stix&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;pattern_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;valid_from&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:04:40.048932Z&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">},</span>\n",
" <span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--389c934c-258c-44fb-ae4b-14c6c12270f6&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T14:53:20.156644Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T14:53:20.156644Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;name&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;Poison Ivy&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;is_family&quot;</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">},</span>\n",
" <span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;relationship--2f6a8785-e27b-487e-b870-b85a2121502d&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;created&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:18.250605Z&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;modified&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2020-06-24T15:05:18.250605Z&quot;</span><span class=\"p\">,</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"nt\">&quot;relationship_type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicates&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;source_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;indicator--a862ff86-68d9-42e5-8095-cd80c040e112&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;target_ref&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;malware--389c934c-258c-44fb-ae4b-14c6c12270f6&quot;</span>\n",
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
" <span class=\"p\">}</span>\n",
" <span class=\"p\">]</span>\n",
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 21,
Add JSON syntax highlighting to docs' output cells Uses a hidden cell in the Jupyter notebook to monkeypatch print.
2017-09-26 20:39:32 +02:00
"metadata": {},
"output_type": "execute_result"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"source": [
"from stix2 import Bundle\n",
"\n",
"bundle = Bundle(indicator, malware, relationship)\n",
"print(bundle)"
]
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Creating Cyber Observable References\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"Cyber Observable Objects have properties that can reference other Cyber Observable Objects. In order to create those references, either supply the ID string of the object being referenced, or pass in the object itself.\n",
Update _valid_refs doc and add test to v20 test suite
2019-05-13 15:18:50 +02:00
"\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"For example, the IPv4Address object has a ``resolves_to_refs`` property which must hold a list of references to MACAddress objects. We could specify the id string:"
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 22,
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
"metadata": {},
"outputs": [
{
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ipv4-addr&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445&quot;</span><span class=\"p\">,</span>\n",
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
" <span class=\"nt\">&quot;value&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;177.60.40.7&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;resolves_to_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"s2\">&quot;mac-addr--43f380fd-37c6-476d-8643-60849bf9240e&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span>\n",
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 22,
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"from stix2 import IPv4Address\n",
"\n",
"ip4 = IPv4Address(\n",
" value=\"177.60.40.7\",\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" resolves_to_refs=[\"mac-addr--43f380fd-37c6-476d-8643-60849bf9240e\"]\n",
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
")\n",
"\n",
"print(ip4)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"Or we could create the MACAddress object(s) beforehand and then pass them in:"
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
]
},
{
"cell_type": "code",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 23,
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
"metadata": {},
Updated documentation for _valid_refs
2019-05-10 18:30:52 +02:00
"outputs": [
{
"data": {
"text/html": [
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
".highlight { background: #f8f8f8; }\n",
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
".highlight .o { color: #666666 } /* Operator */\n",
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
".highlight .go { color: #888888 } /* Generic.Output */\n",
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
".highlight .m { color: #666666 } /* Literal.Number */\n",
".highlight .s { color: #BA2121 } /* Literal.String */\n",
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
".highlight .no { color: #880000 } /* Name.Constant */\n",
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
".highlight .nf { color: #0000FF } /* Name.Function */\n",
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
".highlight .nv { color: #19177C } /* Name.Variable */\n",
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
" <span class=\"nt\">&quot;type&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ipv4-addr&quot;</span><span class=\"p\">,</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"nt\">&quot;id&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445&quot;</span><span class=\"p\">,</span>\n",
Updated documentation for _valid_refs
2019-05-10 18:30:52 +02:00
" <span class=\"nt\">&quot;value&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;177.60.40.7&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"nt\">&quot;resolves_to_refs&quot;</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" <span class=\"s2\">&quot;mac-addr--f72d7d00-86bd-5cd2-8c86-52f7a83bef62&quot;</span><span class=\"p\">,</span>\n",
" <span class=\"s2\">&quot;mac-addr--875ad625-177b-5c2a-9101-d44b0ad55938&quot;</span>\n",
" <span class=\"p\">],</span>\n",
" <span class=\"nt\">&quot;spec_version&quot;</span><span class=\"p\">:</span> <span class=\"s2\">&quot;2.1&quot;</span>\n",
Updated documentation for _valid_refs
2019-05-10 18:30:52 +02:00
"<span class=\"p\">}</span>\n",
"</pre></div>\n"
],
"text/plain": [
"<IPython.core.display.HTML object>"
]
},
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"execution_count": 23,
Updated documentation for _valid_refs
2019-05-10 18:30:52 +02:00
"metadata": {},
"output_type": "execute_result"
}
],
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
"source": [
"from stix2 import MACAddress\n",
"\n",
"mac_addr_a = MACAddress(value=\"a1:b2:c3:d4:e5:f6\")\n",
"mac_addr_b = MACAddress(value=\"a7:b8:c9:d0:e1:f2\")\n",
"\n",
"ip4_valid_refs = IPv4Address(\n",
" value=\"177.60.40.7\",\n",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
" resolves_to_refs=[mac_addr_a.id, mac_addr_b.id]\n",
Add documentation for _valid_refs
2019-05-10 17:54:59 +02:00
")\n",
"\n",
"print(ip4_valid_refs)"
]
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
],
"metadata": {
"kernelspec": {
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"display_name": "Python 3",
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
"language": "python",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"name": "python3"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
},
"language_info": {
"codemirror_mode": {
"name": "ipython",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"version": 3
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
},
"file_extension": ".py",
"mimetype": "text/x-python",
"name": "python",
"nbconvert_exporter": "python",
Update docs for 2.1 as default
2020-06-26 22:22:50 +02:00
"pygments_lexer": "ipython3",
"version": "3.9.0a6"
Add documentation as Jupyter notebooks - Creating STIX Content - Serializing STIX Objects - Parsing STIX Content - Versioning
2017-09-15 15:53:00 +02:00
}
},
"nbformat": 4,
"nbformat_minor": 2
}