From 1c9a16ea77dadd9494c23139a81f02c14da7a212 Mon Sep 17 00:00:00 2001 From: Chris Lenk Date: Wed, 4 Oct 2017 11:05:33 -0400 Subject: [PATCH] Update markings docs with latest update --- docs/guide/markings.ipynb | 202 +++++++++++++++++++++----------------- 1 file changed, 110 insertions(+), 92 deletions(-) diff --git a/docs/guide/markings.ipynb b/docs/guide/markings.ipynb index 5c6262d..cb8f762 100644 --- a/docs/guide/markings.ipynb +++ b/docs/guide/markings.ipynb @@ -146,14 +146,14 @@ ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--aa0a1159-32b8-44d7-ba58-574ab6b9c9af",\n",
-       "    "created": "2017-09-26T23:38:12.161Z",\n",
-       "    "modified": "2017-09-26T23:38:12.161Z",\n",
+       "    "id": "indicator--409a0b15-1108-4251-8aee-a08995976561",\n",
+       "    "created": "2017-10-04T14:42:54.685Z",\n",
+       "    "modified": "2017-10-04T14:42:54.685Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:12.161492Z",\n",
+       "    "valid_from": "2017-10-04T14:42:54.685184Z",\n",
        "    "object_marking_refs": [\n",
        "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
        "    ]\n",
@@ -263,8 +263,8 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "marking-definition",\n",
-       "    "id": "marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b",\n",
-       "    "created": "2017-09-26T23:38:13.988639Z",\n",
+       "    "id": "marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53",\n",
+       "    "created": "2017-10-04T14:43:04.090873Z",\n",
        "    "definition_type": "statement",\n",
        "    "definition": {\n",
        "        "statement": "Copyright 2017, Example Corp"\n",
@@ -376,16 +376,16 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--79913250-0e10-45d2-925d-53ee3747eac5",\n",
-       "    "created": "2017-09-26T23:38:15.669Z",\n",
-       "    "modified": "2017-09-26T23:38:15.669Z",\n",
+       "    "id": "indicator--526cda4e-6745-4cd6-852f-0750c6a79784",\n",
+       "    "created": "2017-10-04T14:43:09.586Z",\n",
+       "    "modified": "2017-10-04T14:43:09.586Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:15.669626Z",\n",
+       "    "valid_from": "2017-10-04T14:43:09.586133Z",\n",
        "    "object_marking_refs": [\n",
-       "        "marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b"\n",
+       "        "marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53"\n",
        "    ]\n",
        "}\n",
        "
\n"
@@ -484,14 +484,14 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--f96f6de3-184d-4d18-85cd-c1517265b775",\n",
-       "    "created": "2017-09-26T23:38:17.187Z",\n",
-       "    "modified": "2017-09-26T23:38:17.187Z",\n",
+       "    "id": "indicator--1505b789-fcd2-48ee-bea9-3b20627a4abd",\n",
+       "    "created": "2017-10-04T14:43:20.049Z",\n",
+       "    "modified": "2017-10-04T14:43:20.049Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:17.18725Z",\n",
+       "    "valid_from": "2017-10-04T14:43:20.049166Z",\n",
        "    "object_marking_refs": [\n",
        "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
        "    ]\n",
@@ -599,9 +599,9 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "malware",\n",
-       "    "id": "malware--1c57d899-1255-4f08-b084-289296b3aa0d",\n",
-       "    "created": "2017-09-26T23:38:18.729Z",\n",
-       "    "modified": "2017-09-26T23:38:18.729Z",\n",
+       "    "id": "malware--9f8970eb-b398-41b6-b8c8-8a607ad3a2c5",\n",
+       "    "created": "2017-10-04T14:43:26.129Z",\n",
+       "    "modified": "2017-10-04T14:43:26.129Z",\n",
        "    "name": "Poison Ivy",\n",
        "    "description": "A ransomware related to ...",\n",
        "    "labels": [\n",
@@ -609,7 +609,7 @@
        "    ],\n",
        "    "granular_markings": [\n",
        "        {\n",
-       "            "marking_ref": "marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b",\n",
+       "            "marking_ref": "marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53",\n",
        "            "selectors": [\n",
        "                "description"\n",
        "            ]\n",
@@ -696,12 +696,14 @@
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "Both object markings and granular markings can also be added to STIX objects which have already been created. Doing so will create a new version of the object (note the updated ``modified`` time)."
+    "Both object markings and granular markings can also be added to STIX objects which have already been created.\n",
+    "\n",
+    "**Note**: Doing so will create a new version of the object (note the updated ``modified`` time)."
    ]
   },
   {
    "cell_type": "code",
-   "execution_count": 9,
+   "execution_count": 21,
    "metadata": {},
    "outputs": [
     {
@@ -777,17 +779,17 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--aa0a1159-32b8-44d7-ba58-574ab6b9c9af",\n",
-       "    "created": "2017-09-26T23:38:12.161Z",\n",
-       "    "modified": "2017-09-26T23:38:22.548Z",\n",
+       "    "id": "indicator--409a0b15-1108-4251-8aee-a08995976561",\n",
+       "    "created": "2017-10-04T14:42:54.685Z",\n",
+       "    "modified": "2017-10-04T15:03:46.599Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:12.161492Z",\n",
+       "    "valid_from": "2017-10-04T14:42:54.685184Z",\n",
        "    "object_marking_refs": [\n",
-       "        "marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b",\n",
-       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
+       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",\n",
+       "        "marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53"\n",
        "    ]\n",
        "}\n",
        "
\n"
@@ -796,15 +798,13 @@
        ""
       ]
      },
-     "execution_count": 9,
+     "execution_count": 21,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
-    "from stix2.markings import add_markings\n",
-    "\n",
-    "indicator4 = add_markings(indicator, marking_definition.id)\n",
+    "indicator4 = indicator.add_markings(marking_definition)\n",
     "print(indicator4)"
    ]
   },
@@ -817,7 +817,7 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 10,
+   "execution_count": 22,
    "metadata": {},
    "outputs": [
     {
@@ -893,14 +893,14 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--aa0a1159-32b8-44d7-ba58-574ab6b9c9af",\n",
-       "    "created": "2017-09-26T23:38:12.161Z",\n",
-       "    "modified": "2017-09-26T23:38:24.574Z",\n",
+       "    "id": "indicator--409a0b15-1108-4251-8aee-a08995976561",\n",
+       "    "created": "2017-10-04T14:42:54.685Z",\n",
+       "    "modified": "2017-10-04T15:03:54.290Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:12.161492Z",\n",
+       "    "valid_from": "2017-10-04T14:42:54.685184Z",\n",
        "    "object_marking_refs": [\n",
        "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
        "    ]\n",
@@ -911,15 +911,13 @@
        ""
       ]
      },
-     "execution_count": 10,
+     "execution_count": 22,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
-    "from stix2.markings import remove_markings\n",
-    "\n",
-    "indicator5 = remove_markings(indicator4, marking_definition.id)\n",
+    "indicator5 = indicator4.remove_markings(marking_definition)\n",
     "print(indicator5)"
    ]
   },
@@ -932,7 +930,7 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 11,
+   "execution_count": 23,
    "metadata": {},
    "outputs": [
     {
@@ -1008,17 +1006,17 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--aa0a1159-32b8-44d7-ba58-574ab6b9c9af",\n",
-       "    "created": "2017-09-26T23:38:12.161Z",\n",
-       "    "modified": "2017-09-26T23:38:26.215Z",\n",
+       "    "id": "indicator--409a0b15-1108-4251-8aee-a08995976561",\n",
+       "    "created": "2017-10-04T14:42:54.685Z",\n",
+       "    "modified": "2017-10-04T15:04:04.218Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:12.161492Z",\n",
+       "    "valid_from": "2017-10-04T14:42:54.685184Z",\n",
        "    "object_marking_refs": [\n",
-       "        "marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b",\n",
-       "        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"\n",
+       "        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
+       "        "marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53"\n",
        "    ]\n",
        "}\n",
        "
\n"
@@ -1027,16 +1025,15 @@
        ""
       ]
      },
-     "execution_count": 11,
+     "execution_count": 23,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
     "from stix2 import TLP_GREEN\n",
-    "from stix2.markings import set_markings\n",
     "\n",
-    "indicator6 = set_markings(indicator5, [TLP_GREEN.id, marking_definition.id])\n",
+    "indicator6 = indicator5.set_markings([TLP_GREEN, marking_definition])\n",
     "print(indicator6)"
    ]
   },
@@ -1125,14 +1122,14 @@
        ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
        ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
{\n",
        "    "type": "indicator",\n",
-       "    "id": "indicator--aa0a1159-32b8-44d7-ba58-574ab6b9c9af",\n",
-       "    "created": "2017-09-26T23:38:12.161Z",\n",
-       "    "modified": "2017-09-26T23:38:27.900Z",\n",
+       "    "id": "indicator--409a0b15-1108-4251-8aee-a08995976561",\n",
+       "    "created": "2017-10-04T14:42:54.685Z",\n",
+       "    "modified": "2017-10-04T14:54:39.331Z",\n",
        "    "labels": [\n",
        "        "malicious-activity"\n",
        "    ],\n",
        "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
-       "    "valid_from": "2017-09-26T23:38:12.161492Z"\n",
+       "    "valid_from": "2017-10-04T14:42:54.685184Z"\n",
        "}\n",
        "
\n"
       ],
@@ -1146,9 +1143,7 @@
     }
    ],
    "source": [
-    "from stix2.markings import clear_markings\n",
-    "\n",
-    "indicator7 = clear_markings(indicator5)\n",
+    "indicator7 = indicator5.clear_markings()\n",
     "print(indicator7)"
    ]
   },
@@ -1170,32 +1165,57 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 13,
+   "execution_count": 19,
    "metadata": {},
    "outputs": [
     {
      "data": {
       "text/plain": [
-       "['marking-definition--b039cd22-b453-40c7-b9d8-20f8ae1ba29b',\n",
-       " 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']"
+       "['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da',\n",
+       " 'marking-definition--030bb5c6-c5eb-4e9c-8e7a-b9aab08ded53']"
       ]
      },
-     "execution_count": 13,
+     "execution_count": 19,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
-    "from stix2.markings import get_markings\n",
-    "\n",
-    "get_markings(indicator6)"
+    "indicator6.get_markings()"
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "You can also get a list of granular markings by passing a list of selectors to ``get_markings``:"
+    "To get a list of the granular markings on an object, pass the object and a list of selectors to ``get_markings``:"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 20,
+   "metadata": {},
+   "outputs": [
+    {
+     "data": {
+      "text/plain": [
+       "['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']"
+      ]
+     },
+     "execution_count": 20,
+     "metadata": {},
+     "output_type": "execute_result"
+    }
+   ],
+   "source": [
+    "malware.get_markings('name')"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "You can also call ``get_markings()`` as a method on the STIX object."
    ]
   },
   {
@@ -1215,36 +1235,14 @@
     }
    ],
    "source": [
-    "get_markings(malware, 'name')"
+    "malware.get_markings('name')"
    ]
   },
   {
    "cell_type": "markdown",
    "metadata": {},
    "source": [
-    "You can also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors."
-   ]
-  },
-  {
-   "cell_type": "code",
-   "execution_count": 15,
-   "metadata": {},
-   "outputs": [
-    {
-     "data": {
-      "text/plain": [
-       "True"
-      ]
-     },
-     "execution_count": 15,
-     "metadata": {},
-     "output_type": "execute_result"
-    }
-   ],
-   "source": [
-    "from stix2.markings import is_marked\n",
-    "\n",
-    "is_marked(indicator, TLP_AMBER.id)"
+    "Finally, you may also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors."
    ]
   },
   {
@@ -1264,12 +1262,32 @@
     }
    ],
    "source": [
-    "is_marked(malware, TLP_WHITE.id, 'name')"
+    "indicator.is_marked(TLP_AMBER.id)"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": 17,
+   "metadata": {},
+   "outputs": [
+    {
+     "data": {
+      "text/plain": [
+       "True"
+      ]
+     },
+     "execution_count": 17,
+     "metadata": {},
+     "output_type": "execute_result"
+    }
+   ],
+   "source": [
+    "malware.is_marked(TLP_WHITE.id, 'name')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 18,
    "metadata": {
     "scrolled": true
    },
@@ -1280,13 +1298,13 @@
        "False"
       ]
      },
-     "execution_count": 17,
+     "execution_count": 18,
      "metadata": {},
      "output_type": "execute_result"
     }
    ],
    "source": [
-    "is_marked(malware, TLP_WHITE.id, 'description')"
+    "malware.is_marked(TLP_WHITE.id, 'description')"
    ]
   }
  ],