Chris Lenk
GitHub
commit
1e612688fe
26
README.rst
26
README.rst
|
|
@ -33,7 +33,8 @@ be set automatically if not provided as keyword arguments.
|
||||||
from stix2 import Indicator
|
from stix2 import Indicator
|
||||||
|
|
||||||
indicator = Indicator(name="File hash for malware variant",
|
indicator = Indicator(name="File hash for malware variant",
|
||||||
labels=["malicious-activity"],
|
indicator_types=["malicious-activity"],
|
||||||
|
pattern_type="stix",
|
||||||
pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']")
|
pattern="[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']")
|
||||||
|
|
||||||
To parse a STIX JSON string into a Python STIX object, use ``parse()``:
|
To parse a STIX JSON string into a Python STIX object, use ``parse()``:
|
||||||
|
|
@ -53,6 +54,7 @@ To parse a STIX JSON string into a Python STIX object, use ``parse()``:
|
||||||
"malicious-activity"
|
"malicious-activity"
|
||||||
],
|
],
|
||||||
"pattern_type": "stix",
|
"pattern_type": "stix",
|
||||||
|
"pattern_version": "2.1",
|
||||||
"pattern": "[file:hashes.md5 ='d41d8cd98f00b204e9800998ecf8427e']",
|
"pattern": "[file:hashes.md5 ='d41d8cd98f00b204e9800998ecf8427e']",
|
||||||
"valid_from": "2017-09-26T23:33:39.829952Z"
|
"valid_from": "2017-09-26T23:33:39.829952Z"
|
||||||
}""")
|
}""")
|
||||||
|
|
@ -61,18 +63,20 @@ To parse a STIX JSON string into a Python STIX object, use ``parse()``:
|
||||||
|
|
||||||
For more in-depth documentation, please see `https://stix2.readthedocs.io/ <https://stix2.readthedocs.io/>`__.
|
For more in-depth documentation, please see `https://stix2.readthedocs.io/ <https://stix2.readthedocs.io/>`__.
|
||||||
|
|
||||||
STIX 2.X Technical Specification Support
|
STIX 2 Technical Specification Support
|
||||||
----------------------------------------
|
--------------------------------------
|
||||||
|
|
||||||
This version of python-stix2 brings initial support to STIX 2.1 currently at the
|
This version of cti-python-stix2 brings support to `STIX Version 2.1 <https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html>`__
|
||||||
CSD level. The intention is to help debug components of the library and also
|
published on 20 March 2020 currently at the Committee Specification (CS) level.
|
||||||
check for problems that should be fixed in the specification.
|
|
||||||
|
|
||||||
The `stix2` Python library is built to support multiple versions of the STIX
|
The stix2 Python library supports multiple versions of the STIX 2 Technical
|
||||||
Technical Specification. With every major release of stix2 the ``import stix2``
|
Specification. The library will be updated to support new Committee
|
||||||
statement will automatically load the SDO/SROs equivalent to the most recent
|
Specification Drafts (CSDs) as they are released, but modules for these
|
||||||
supported 2.X Committee Specification. Please see the library documentation for
|
versions must be imported manually until the CSD reaches CS level. In new
|
||||||
more details.
|
major releases of stix2 the ``import stix2`` implicit import statement
|
||||||
|
will be updated to automatically load the STIX Objects equivalent to the most
|
||||||
|
recently supported CS. Please see the `library documentation <https://stix2.readthedocs.io/en/latest/guide/ts_support.html>`__
|
||||||
|
for details.
|
||||||
|
|
||||||
Governance
|
Governance
|
||||||
----------
|
----------
|
||||||
|
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
core
|
|
||||||
==========
|
|
||||||
|
|
||||||
.. automodule:: stix2.core
|
|
||||||
:members:
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
parsing
|
||||||
|
===============
|
||||||
|
|
||||||
|
.. automodule:: stix2.parsing
|
||||||
|
:members:
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
pattern_visitor
|
||||||
|
================
|
||||||
|
|
||||||
|
.. automodule:: stix2.pattern_visitor
|
||||||
|
:members:
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
versioning
|
||||||
|
===============
|
||||||
|
|
||||||
|
.. automodule:: stix2.versioning
|
||||||
|
:members:
|
||||||
|
|
@ -10,11 +10,13 @@
|
||||||
"source": [
|
"source": [
|
||||||
"# Delete this cell to re-enable tracebacks\n",
|
"# Delete this cell to re-enable tracebacks\n",
|
||||||
"import sys\n",
|
"import sys\n",
|
||||||
|
"import traceback\n",
|
||||||
"ipython = get_ipython()\n",
|
"ipython = get_ipython()\n",
|
||||||
"\n",
|
"\n",
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info() \n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -68,7 +70,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 3,
|
"execution_count": 15,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -144,15 +146,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--2f3d4926-163d-4aef-bcd2-19dea96916ae"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a862ff86-68d9-42e5-8095-cd80c040e112"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509629Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -160,7 +162,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 3,
|
"execution_count": 15,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -169,8 +171,8 @@
|
||||||
"from stix2 import Indicator\n",
|
"from stix2 import Indicator\n",
|
||||||
"\n",
|
"\n",
|
||||||
"indicator = Indicator(name=\"File hash for malware variant\",\n",
|
"indicator = Indicator(name=\"File hash for malware variant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern_type=\"stix\")\n",
|
||||||
"print(indicator)"
|
"print(indicator)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -185,12 +187,12 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 4,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"indicator2 = Indicator(type='indicator',\n",
|
"indicator2 = Indicator(type='indicator',\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -203,7 +205,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 5,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -217,7 +219,7 @@
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"indicator3 = Indicator(type='xxx',\n",
|
"indicator3 = Indicator(type='xxx',\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -231,7 +233,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 6,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -245,7 +247,7 @@
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"indicator4 = Indicator(id=\"campaign--63ce9068-b5ab-47fa-a2cf-a602ea01f21a\",\n",
|
"indicator4 = Indicator(id=\"campaign--63ce9068-b5ab-47fa-a2cf-a602ea01f21a\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -253,20 +255,20 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"For indicators, ``labels`` and ``pattern`` are required and cannot be set automatically. Trying to create an indicator that is missing one of these properties will result in an error:"
|
"For indicators, ``pattern`` and ``pattern_type`` are required and cannot be set automatically. Trying to create an indicator that is missing one of these properties will result in an error:"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 7,
|
"execution_count": 8,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"ename": "MissingPropertiesError",
|
"ename": "MissingPropertiesError",
|
||||||
"evalue": "No values for required properties for Indicator: (labels, pattern).",
|
"evalue": "No values for required properties for Indicator: (pattern, pattern_type).",
|
||||||
"output_type": "error",
|
"output_type": "error",
|
||||||
"traceback": [
|
"traceback": [
|
||||||
"\u001b[0;31mMissingPropertiesError\u001b[0m\u001b[0;31m:\u001b[0m No values for required properties for Indicator: (labels, pattern).\n"
|
"\u001b[0;31mMissingPropertiesError\u001b[0m\u001b[0;31m:\u001b[0m No values for required properties for Indicator: (pattern, pattern_type).\n"
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
|
@ -285,7 +287,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 8,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -294,7 +296,7 @@
|
||||||
"'File hash for malware variant'"
|
"'File hash for malware variant'"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 8,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -312,7 +314,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 9,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -321,7 +323,7 @@
|
||||||
"'File hash for malware variant'"
|
"'File hash for malware variant'"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 9,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -352,7 +354,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 10,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -370,7 +372,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 11,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -402,7 +404,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 12,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -478,13 +480,12 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--1f2aba70-f0ae-49cd-9267-6fcb1e43be67"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:04.698Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--389c934c-258c-44fb-ae4b-14c6c12270f6"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:04.698Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T14:53:20.156644Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T14:53:20.156644Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
|
||||||
" <span class=\"s2\">"remote-access-trojan"</span>\n",
|
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -492,7 +493,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 12,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -501,7 +502,7 @@
|
||||||
"from stix2 import Malware\n",
|
"from stix2 import Malware\n",
|
||||||
"\n",
|
"\n",
|
||||||
"malware = Malware(name=\"Poison Ivy\",\n",
|
"malware = Malware(name=\"Poison Ivy\",\n",
|
||||||
" labels=['remote-access-trojan'])\n",
|
" is_family=False)\n",
|
||||||
"print(malware)"
|
"print(malware)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -509,9 +510,9 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"As with indicators, the ``type``, ``id``, ``created``, and ``modified`` properties will be set automatically if not provided. For Malware objects, the ``labels`` and ``name`` properties must be provided.\n",
|
"As with indicators, the ``type``, ``id``, ``created``, and ``modified`` properties will be set automatically if not provided. For Malware objects, the ``is_family`` property must be provided.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"You can see the full list of SDO classes [here](../api/v20/stix2.v20.sdo.rst)."
|
"You can see the full list of SDO classes [here](../api/v21/stix2.v21.sdo.rst)."
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -525,7 +526,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 13,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -601,12 +602,13 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--80c174fa-36d1-47c2-9a9d-ce0c636bedcc"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:13.152Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--2f6a8785-e27b-487e-b870-b85a2121502d"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:13.152Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:18.250605Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:18.250605Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--2f3d4926-163d-4aef-bcd2-19dea96916ae"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a862ff86-68d9-42e5-8095-cd80c040e112"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--1f2aba70-f0ae-49cd-9267-6fcb1e43be67"</span>\n",
|
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--389c934c-258c-44fb-ae4b-14c6c12270f6"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -614,7 +616,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 13,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -637,7 +639,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 14,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -713,12 +715,13 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--47395d23-dedd-45d4-8db1-c9ffaf44493d"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:16.566Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--d43ec245-5496-44f4-8732-3131380435de"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:16.566Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:47.705352Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:47.705352Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--2f3d4926-163d-4aef-bcd2-19dea96916ae"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a862ff86-68d9-42e5-8095-cd80c040e112"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--1f2aba70-f0ae-49cd-9267-6fcb1e43be67"</span>\n",
|
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--389c934c-258c-44fb-ae4b-14c6c12270f6"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -726,7 +729,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 14,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -747,7 +750,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 15,
|
"execution_count": 21,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -823,39 +826,38 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"bundle"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"bundle"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"bundle--388c9b2c-936c-420a-baa5-04f48d682a01"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"bundle--177c6477-2dee-43d5-b4c9-8b7f3f5ec517"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.0"</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--2f3d4926-163d-4aef-bcd2-19dea96916ae"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a862ff86-68d9-42e5-8095-cd80c040e112"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:14:48.509629Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:04:40.048932Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
" <span class=\"p\">},</span>\n",
|
" <span class=\"p\">},</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--1f2aba70-f0ae-49cd-9267-6fcb1e43be67"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:04.698Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--389c934c-258c-44fb-ae4b-14c6c12270f6"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:04.698Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T14:53:20.156644Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T14:53:20.156644Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
|
||||||
" <span class=\"s2\">"remote-access-trojan"</span>\n",
|
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
" <span class=\"p\">},</span>\n",
|
" <span class=\"p\">},</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--80c174fa-36d1-47c2-9a9d-ce0c636bedcc"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:13.152Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"relationship--2f6a8785-e27b-487e-b870-b85a2121502d"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-05-13T13:15:13.152Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:18.250605Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T15:05:18.250605Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"relationship_type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicates"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--2f3d4926-163d-4aef-bcd2-19dea96916ae"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a862ff86-68d9-42e5-8095-cd80c040e112"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--1f2aba70-f0ae-49cd-9267-6fcb1e43be67"</span>\n",
|
" <span class=\"nt\">"target_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--389c934c-258c-44fb-ae4b-14c6c12270f6"</span>\n",
|
||||||
" <span class=\"p\">}</span>\n",
|
" <span class=\"p\">}</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">]</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -865,7 +867,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 21,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -882,22 +884,14 @@
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"### Creating Cyber Observable References\n",
|
"### Creating Cyber Observable References\n",
|
||||||
"Cyber Observable Objects have properties that can reference other Cyber Observable Objects. In order to create those references, use the ``_valid_refs`` property as shown in the following examples. It should be noted that ``_valid_refs`` is necessary when creating references to Cyber Observable Objects since some embedded references can only point to certain types, and ``_valid_refs`` helps ensure consistency. \n",
|
"Cyber Observable Objects have properties that can reference other Cyber Observable Objects. In order to create those references, either supply the ID string of the object being referenced, or pass in the object itself.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"There are two cases."
|
"For example, the IPv4Address object has a ``resolves_to_refs`` property which must hold a list of references to MACAddress objects. We could specify the id string:"
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"cell_type": "markdown",
|
|
||||||
"metadata": {},
|
|
||||||
"source": [
|
|
||||||
"#### Case 1: Specifying the type of the Cyber Observable Objects being referenced\n",
|
|
||||||
"In the following example, the IPv4Address object has its ``resolves_to_refs`` property specified. As per the spec, this property's value must be a list of reference(s) to MACAddress objects. In this case, those references are strings that state the type of the Cyber Observable Object being referenced, and are provided in ``_valid_refs``."
|
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 16,
|
"execution_count": 22,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -973,11 +967,12 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"value"</span><span class=\"p\">:</span> <span class=\"s2\">"177.60.40.7"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"value"</span><span class=\"p\">:</span> <span class=\"s2\">"177.60.40.7"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"resolves_to_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"resolves_to_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"1"</span><span class=\"p\">,</span>\n",
|
" <span class=\"s2\">"mac-addr--43f380fd-37c6-476d-8643-60849bf9240e"</span>\n",
|
||||||
" <span class=\"s2\">"2"</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -985,7 +980,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 16,
|
"execution_count": 22,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -994,9 +989,8 @@
|
||||||
"from stix2 import IPv4Address\n",
|
"from stix2 import IPv4Address\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ip4 = IPv4Address(\n",
|
"ip4 = IPv4Address(\n",
|
||||||
" _valid_refs={\"1\": \"mac-addr\", \"2\": \"mac-addr\"},\n",
|
|
||||||
" value=\"177.60.40.7\",\n",
|
" value=\"177.60.40.7\",\n",
|
||||||
" resolves_to_refs=[\"1\", \"2\"]\n",
|
" resolves_to_refs=[\"mac-addr--43f380fd-37c6-476d-8643-60849bf9240e\"]\n",
|
||||||
")\n",
|
")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"print(ip4)"
|
"print(ip4)"
|
||||||
|
|
@ -1006,13 +1000,12 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"#### Case 2: Specifying the name of the Cyber Observable Objects being referenced\n",
|
"Or we could create the MACAddress object(s) beforehand and then pass them in:"
|
||||||
"The following example is just like the one provided in Case 1 above, with one key difference: instead of using strings to specify the type of the Cyber Observable Objects being referenced in ``_valid_refs``, the referenced Cyber Observable Objects are created beforehand and then their names are provided in ``_valid_refs``."
|
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 17,
|
"execution_count": 23,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1088,11 +1081,13 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"ipv4-addr--dc63603e-e634-5357-b239-d4b562bc5445"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"value"</span><span class=\"p\">:</span> <span class=\"s2\">"177.60.40.7"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"value"</span><span class=\"p\">:</span> <span class=\"s2\">"177.60.40.7"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"resolves_to_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"resolves_to_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"1"</span><span class=\"p\">,</span>\n",
|
" <span class=\"s2\">"mac-addr--f72d7d00-86bd-5cd2-8c86-52f7a83bef62"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"2"</span>\n",
|
" <span class=\"s2\">"mac-addr--875ad625-177b-5c2a-9101-d44b0ad55938"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -1100,7 +1095,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 17,
|
"execution_count": 23,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -1112,9 +1107,8 @@
|
||||||
"mac_addr_b = MACAddress(value=\"a7:b8:c9:d0:e1:f2\")\n",
|
"mac_addr_b = MACAddress(value=\"a7:b8:c9:d0:e1:f2\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ip4_valid_refs = IPv4Address(\n",
|
"ip4_valid_refs = IPv4Address(\n",
|
||||||
" _valid_refs={\"1\": mac_addr_a, \"2\": mac_addr_b},\n",
|
|
||||||
" value=\"177.60.40.7\",\n",
|
" value=\"177.60.40.7\",\n",
|
||||||
" resolves_to_refs=[\"1\", \"2\"]\n",
|
" resolves_to_refs=[mac_addr_a.id, mac_addr_b.id]\n",
|
||||||
")\n",
|
")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"print(ip4_valid_refs)"
|
"print(ip4_valid_refs)"
|
||||||
|
|
@ -1123,21 +1117,21 @@
|
||||||
],
|
],
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"kernelspec": {
|
"kernelspec": {
|
||||||
"display_name": "Python 2",
|
"display_name": "Python 3",
|
||||||
"language": "python",
|
"language": "python",
|
||||||
"name": "python2"
|
"name": "python3"
|
||||||
},
|
},
|
||||||
"language_info": {
|
"language_info": {
|
||||||
"codemirror_mode": {
|
"codemirror_mode": {
|
||||||
"name": "ipython",
|
"name": "ipython",
|
||||||
"version": 2
|
"version": 3
|
||||||
},
|
},
|
||||||
"file_extension": ".py",
|
"file_extension": ".py",
|
||||||
"mimetype": "text/x-python",
|
"mimetype": "text/x-python",
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython2",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "2.7.15"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -175,9 +176,10 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--d6996982-5fb7-4364-b716-b618516989b6"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:27.349Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--a4c49251-0ad1-44e6-8cfc-3dbd75e73fbd"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:27.349Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:07.107425Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:07.107425Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n",
|
" <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n",
|
||||||
|
|
@ -287,9 +289,10 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--a167d2de-9fc4-4734-a1ae-57a548aad22a"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:29.180Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--50c33f36-362b-4815-9f97-f3c7f39aa691"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:29.180Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:15.435425Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:15.435425Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n",
|
" <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n",
|
||||||
|
|
@ -317,7 +320,7 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"Likewise, when parsing STIX content with custom properties, pass ``allow_custom=True`` to [parse()](../api/stix2.core.rst#stix2.core.parse):"
|
"Likewise, when parsing STIX content with custom properties, pass ``allow_custom=True`` to [parse()](../api/stix2.parsing.rst#stix2.parsing.parse):"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -413,6 +416,7 @@
|
||||||
"\n",
|
"\n",
|
||||||
"input_string = \"\"\"{\n",
|
"input_string = \"\"\"{\n",
|
||||||
" \"type\": \"identity\",\n",
|
" \"type\": \"identity\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n",
|
" \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n",
|
||||||
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
|
|
@ -428,7 +432,7 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"To remove a custom properties, use `new_version()` and set it to `None`."
|
"To remove a custom properties, use `new_version()` and set that property to `None`."
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -509,9 +513,10 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:32.934Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:24.099Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -537,7 +542,7 @@
|
||||||
"source": [
|
"source": [
|
||||||
"### Custom STIX Object Types\n",
|
"### Custom STIX Object Types\n",
|
||||||
"\n",
|
"\n",
|
||||||
"To create a custom STIX object type, define a class with the @[CustomObject](../api/v20/stix2.v20.sdo.rst#stix2.v20.sdo.CustomObject) decorator. It takes the type name and a list of property tuples, each tuple consisting of the property name and a property instance. Any special validation of the properties can be added by supplying an ``__init__`` function.\n",
|
"To create a custom STIX object type, define a class with the @[CustomObject](../api/v21/stix2.v21.sdo.rst#stix2.v21.sdo.CustomObject) decorator. It takes the type name and a list of property tuples, each tuple consisting of the property name and a property instance. Any special validation of the properties can be added by supplying an ``__init__`` function.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"Let's say zoo animals have become a serious cyber threat and we want to model them in STIX using a custom object type. Let's use a ``species`` property to store the kind of animal, and make that property required. We also want a property to store the class of animal, such as \"mammal\" or \"bird\" but only want to allow specific values in it. We can add some logic to validate this property in ``__init__``."
|
"Let's say zoo animals have become a serious cyber threat and we want to model them in STIX using a custom object type. Let's use a ``species`` property to store the kind of animal, and make that property required. We also want a property to store the class of animal, such as \"mammal\" or \"bird\" but only want to allow specific values in it. We can add some logic to validate this property in ``__init__``."
|
||||||
]
|
]
|
||||||
|
|
@ -645,9 +650,10 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal--1f7ce0ad-fd3a-4cf0-9cd7-13f7bef9ecd4"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:38.010Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal--c7dbda16-360a-4622-b9c7-91f0497167cc"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-03-05T05:06:38.010Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:33:29.856926Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:33:29.856926Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"species"</span><span class=\"p\">:</span> <span class=\"s2\">"lion"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"species"</span><span class=\"p\">:</span> <span class=\"s2\">"lion"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"animal_class"</span><span class=\"p\">:</span> <span class=\"s2\">"mammal"</span>\n",
|
" <span class=\"nt\">"animal_class"</span><span class=\"p\">:</span> <span class=\"s2\">"mammal"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -703,7 +709,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 11,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -784,7 +790,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 11,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -795,6 +801,7 @@
|
||||||
" \"id\": \"x-animal--941f1471-6815-456b-89b8-7051ddf13e4b\",\n",
|
" \"id\": \"x-animal--941f1471-6815-456b-89b8-7051ddf13e4b\",\n",
|
||||||
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"species\": \"shark\",\n",
|
" \"species\": \"shark\",\n",
|
||||||
" \"animal_class\": \"fish\"\n",
|
" \"animal_class\": \"fish\"\n",
|
||||||
"}\"\"\"\n",
|
"}\"\"\"\n",
|
||||||
|
|
@ -811,7 +818,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 12,
|
"execution_count": 13,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -841,12 +848,12 @@
|
||||||
"source": [
|
"source": [
|
||||||
"### Custom Cyber Observable Types\n",
|
"### Custom Cyber Observable Types\n",
|
||||||
"\n",
|
"\n",
|
||||||
"Similar to custom STIX object types, use a decorator to create [custom Cyber Observable](../api/v20/stix2.v20.observables.rst#stix2.v20.observables.CustomObservable) types. Just as before, ``__init__()`` can hold additional validation, but it is not necessary."
|
"Similar to custom STIX object types, use a decorator to create [custom Cyber Observable](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomObservable) types. Just as before, ``__init__()`` can hold additional validation, but it is not necessary."
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 13,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -922,6 +929,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable--fdb5fd26-533e-44f4-9463-e8ade73e08c0"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"something"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"something"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">10</span>\n",
|
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">10</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -931,7 +939,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 13,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -962,7 +970,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 14,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1043,7 +1051,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 14,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1125,7 +1133,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 14,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -1136,6 +1144,7 @@
|
||||||
"input_string4 = \"\"\"{\n",
|
"input_string4 = \"\"\"{\n",
|
||||||
" \"type\": \"observed-data\",\n",
|
" \"type\": \"observed-data\",\n",
|
||||||
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n",
|
" \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n",
|
||||||
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
|
|
@ -1171,7 +1180,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 15,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1247,7 +1256,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--6bc655d6-dcb8-52a3-a862-46848c17e599"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">2000</span>\n",
|
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">2000</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -1257,7 +1266,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1334,7 +1343,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--6bc655d6-dcb8-52a3-a862-46848c17e599"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n",
|
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -1344,7 +1353,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1421,7 +1430,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--1e56f9c3-a73b-5fbd-b348-83c76523c4df"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--2945b948-7361-5204-a630-31b828af920c"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A different property"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A different property"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n",
|
" <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -1431,13 +1440,13 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import CustomObservable # IDs and Deterministic IDs are NOT part of STIX 2.0 Custom Observables\n",
|
"from stix2 import CustomObservable\n",
|
||||||
"\n",
|
"\n",
|
||||||
"@CustomObservable('x-new-observable-2', [\n",
|
"@CustomObservable('x-new-observable-2', [\n",
|
||||||
" ('a_property', properties.StringProperty(required=True)),\n",
|
" ('a_property', properties.StringProperty(required=True)),\n",
|
||||||
|
|
@ -1473,12 +1482,12 @@
|
||||||
"source": [
|
"source": [
|
||||||
"### Custom Cyber Observable Extensions\n",
|
"### Custom Cyber Observable Extensions\n",
|
||||||
"\n",
|
"\n",
|
||||||
"Finally, custom extensions to existing Cyber Observable types can also be created. Just use the @[CustomExtension](../api/v20/stix2.v20.observables.rst#stix2.v20.observables.CustomExtension) decorator. Note that you must provide the Cyber Observable class to which the extension applies. Again, any extra validation of the properties can be implemented by providing an ``__init__()`` but it is not required. Let's say we want to make an extension to the ``File`` Cyber Observable Object:"
|
"Finally, custom extensions to existing Cyber Observable types can also be created. Just use the @[CustomExtension](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomExtension) decorator. Note that you must provide the Cyber Observable class to which the extension applies. Again, any extra validation of the properties can be implemented by providing an ``__init__()`` but it is not required. Let's say we want to make an extension to the ``File`` Cyber Observable Object:"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 16,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1562,7 +1571,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 16,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -1591,7 +1600,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 17,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1672,7 +1681,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 17,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1754,7 +1763,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 17,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -1763,6 +1772,7 @@
|
||||||
"input_string5 = \"\"\"{\n",
|
"input_string5 = \"\"\"{\n",
|
||||||
" \"type\": \"observed-data\",\n",
|
" \"type\": \"observed-data\",\n",
|
||||||
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n",
|
" \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n",
|
||||||
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
|
|
@ -1793,21 +1803,21 @@
|
||||||
],
|
],
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"kernelspec": {
|
"kernelspec": {
|
||||||
"display_name": "Python 2",
|
"display_name": "Python 3",
|
||||||
"language": "python",
|
"language": "python",
|
||||||
"name": "python2"
|
"name": "python3"
|
||||||
},
|
},
|
||||||
"language_info": {
|
"language_info": {
|
||||||
"codemirror_mode": {
|
"codemirror_mode": {
|
||||||
"name": "ipython",
|
"name": "ipython",
|
||||||
"version": 2
|
"version": 3
|
||||||
},
|
},
|
||||||
"file_extension": ".py",
|
"file_extension": ".py",
|
||||||
"mimetype": "text/x-python",
|
"mimetype": "text/x-python",
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython2",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "2.7.15+"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -4,7 +4,6 @@
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 1,
|
"execution_count": 1,
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"collapsed": true,
|
|
||||||
"nbsphinx": "hidden"
|
"nbsphinx": "hidden"
|
||||||
},
|
},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
|
|
@ -16,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -25,7 +25,6 @@
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 2,
|
"execution_count": 2,
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"collapsed": true,
|
|
||||||
"nbsphinx": "hidden"
|
"nbsphinx": "hidden"
|
||||||
},
|
},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
|
|
@ -87,7 +86,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 4,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -163,6 +162,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"intrusion-set"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"intrusion-set"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:31:53.197Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:31:53.197Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
|
@ -204,7 +204,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 4,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -281,19 +281,22 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--02b90f02-a96a-43ee-88f1-1e87297941f2"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Ransomware IP Blocklist"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Ransomware IP Blocklist"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"IP Blocklist address from abuse.ch"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"IP Blocklist address from abuse.ch"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[ ipv4-addr:value = '91.237.247.24' ]"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24Z"</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
|
||||||
" <span class=\"s2\">"malicious-activity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"s2\">"malicious-activity"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"Ransomware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"s2\">"Ransomware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"Botnet"</span><span class=\"p\">,</span>\n",
|
" <span class=\"s2\">"Botnet"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"C&C"</span>\n",
|
" <span class=\"s2\">"C&C"</span>\n",
|
||||||
" <span class=\"p\">],</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[ ipv4-addr:value = '91.237.247.24' ]"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-11-13T07:00:24Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"abuse.ch"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"abuse.ch"</span><span class=\"p\">,</span>\n",
|
||||||
|
|
@ -307,7 +310,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 4,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -320,7 +323,7 @@
|
||||||
"fs = FileSystemSource(\"/tmp/stix2_source\")\n",
|
"fs = FileSystemSource(\"/tmp/stix2_source\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# create TAXIICollectionSource\n",
|
"# create TAXIICollectionSource\n",
|
||||||
"colxn = Collection('http://127.0.0.1:5000/trustgroup1/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/')\n",
|
"colxn = Collection('http://127.0.0.1:5000/trustgroup1/collections/91a7b528-80eb-42ed-a74d-c6fbd5a26116/', user=\"user1\", password=\"Password1\")\n",
|
||||||
"ts = TAXIICollectionSource(colxn)\n",
|
"ts = TAXIICollectionSource(colxn)\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# add them both to the CompositeDataSource\n",
|
"# add them both to the CompositeDataSource\n",
|
||||||
|
|
@ -332,7 +335,7 @@
|
||||||
"print(intrusion_set)\n",
|
"print(intrusion_set)\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# get an object that is only in the TAXII collection\n",
|
"# get an object that is only in the TAXII collection\n",
|
||||||
"ind = cs.get('indicator--02b90f02-a96a-43ee-88f1-1e87297941f2')\n",
|
"ind = cs.get('indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7')\n",
|
||||||
"print(ind)"
|
"print(ind)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -357,6 +360,7 @@
|
||||||
"\n",
|
"\n",
|
||||||
"* added_after\n",
|
"* added_after\n",
|
||||||
"* id\n",
|
"* id\n",
|
||||||
|
"* spec_version\n",
|
||||||
"* type\n",
|
"* type\n",
|
||||||
"* version\n",
|
"* version\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -386,10 +390,8 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 3,
|
"execution_count": 10,
|
||||||
"metadata": {
|
"metadata": {},
|
||||||
"collapsed": true
|
|
||||||
},
|
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"import sys\n",
|
"import sys\n",
|
||||||
|
|
@ -420,7 +422,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 6,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -454,7 +456,8 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"**Note: The `defanged` property is now always included (implicitly) for STIX 2.1 Cyber Observable Objects (SCOs)**\n\n",
|
"**Note: The `defanged` property is now always included (implicitly) for STIX 2.1 Cyber Observable Objects (SCOs)**\n",
|
||||||
|
"\n",
|
||||||
"This is important to remember if you are writing a filter that involves checking the `objects` property of a STIX 2.1 `ObservedData` object. If any of the objects associated with the `objects` property are STIX 2.1 SCOs, then your filter must include the `defanged` property. For an example, refer to `filters[14]` & `filters[15]` in stix2/test/v21/test_datastore_filters.py "
|
"This is important to remember if you are writing a filter that involves checking the `objects` property of a STIX 2.1 `ObservedData` object. If any of the objects associated with the `objects` property are STIX 2.1 SCOs, then your filter must include the `defanged` property. For an example, refer to `filters[14]` & `filters[15]` in stix2/test/v21/test_datastore_filters.py "
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -469,10 +472,8 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 10,
|
"execution_count": 14,
|
||||||
"metadata": {
|
"metadata": {},
|
||||||
"collapsed": true
|
|
||||||
},
|
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2 import Campaign, Identity, Indicator, Malware, Relationship\n",
|
"from stix2 import Campaign, Identity, Indicator, Malware, Relationship\n",
|
||||||
|
|
@ -480,8 +481,8 @@
|
||||||
"mem = MemoryStore()\n",
|
"mem = MemoryStore()\n",
|
||||||
"cam = Campaign(name='Charge', description='Attack!')\n",
|
"cam = Campaign(name='Charge', description='Attack!')\n",
|
||||||
"idy = Identity(name='John Doe', identity_class=\"individual\")\n",
|
"idy = Identity(name='John Doe', identity_class=\"individual\")\n",
|
||||||
"ind = Indicator(labels=['malicious-activity'], pattern=\"[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
"ind = Indicator(pattern_type='stix', pattern=\"[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"mal = Malware(labels=['ransomware'], name=\"Cryptolocker\", created_by_ref=idy)\n",
|
"mal = Malware(name=\"Cryptolocker\", is_family=False, created_by_ref=idy)\n",
|
||||||
"rel1 = Relationship(ind, 'indicates', mal,)\n",
|
"rel1 = Relationship(ind, 'indicates', mal,)\n",
|
||||||
"rel2 = Relationship(mal, 'targets', idy)\n",
|
"rel2 = Relationship(mal, 'targets', idy)\n",
|
||||||
"rel3 = Relationship(cam, 'uses', mal)\n",
|
"rel3 = Relationship(cam, 'uses', mal)\n",
|
||||||
|
|
@ -492,12 +493,12 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"If a STIX object has a `created_by_ref` property, you can use the [creator_of()](../api/stix2.datastore.rst#stix2.datastore.DataSource.creator_of) method to retrieve the [Identity](../api/v20/stix2.v20.sdo.rst#stix2.v20.sdo.Identity) object that created it."
|
"If a STIX object has a `created_by_ref` property, you can use the [creator_of()](../api/stix2.datastore.rst#stix2.datastore.DataSource.creator_of) method to retrieve the [Identity](../api/v21/stix2.v21.sdo.rst#stix2.v21.sdo.Identity) object that created it."
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 11,
|
"execution_count": 15,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -573,9 +574,10 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--b67cf8d4-cc1a-4bb7-9402-fffcff17c9a9"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:43:54.117Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--a2628104-e357-44a0-b16f-d5f36c0fd0ec"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:43:54.117Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T13:59:21.924055Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T13:59:21.924055Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Doe"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Doe"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
|
|
@ -585,7 +587,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 11,
|
"execution_count": 15,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -603,7 +605,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 12,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -612,7 +614,7 @@
|
||||||
"3"
|
"3"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 12,
|
"execution_count": 16,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -631,16 +633,16 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 13,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"data": {
|
"data": {
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"[Relationship(type='relationship', id='relationship--3b9cb248-5c2c-425d-85d0-680bfef6e69d', created='2018-04-05T20:43:54.134Z', modified='2018-04-05T20:43:54.134Z', relationship_type='indicates', source_ref='indicator--61deb2a5-305a-490e-83b3-9839a9677368', target_ref='malware--9fe343d8-edf7-4f4a-bb6c-a221fb75142d')]"
|
"[Relationship(type='relationship', spec_version='2.1', id='relationship--ef837187-773c-41e4-ae86-c66189a832f5', created='2020-06-26T13:59:21.929336Z', modified='2020-06-26T13:59:21.929336Z', relationship_type='indicates', source_ref='indicator--9f10f6f2-b93d-488e-be35-72c3ec1087c3', target_ref='malware--315597db-2a74-4a29-8e54-38572e1ac07b')]"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 13,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -658,16 +660,16 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 14,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"data": {
|
"data": {
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"[Relationship(type='relationship', id='relationship--8d322508-423b-4d51-be85-a95ad083f8af', created='2018-04-05T20:43:54.134Z', modified='2018-04-05T20:43:54.134Z', relationship_type='targets', source_ref='malware--9fe343d8-edf7-4f4a-bb6c-a221fb75142d', target_ref='identity--b67cf8d4-cc1a-4bb7-9402-fffcff17c9a9')]"
|
"[Relationship(type='relationship', spec_version='2.1', id='relationship--43f5f7a7-8a99-4bbf-8d93-e6f3fd2951a3', created='2020-06-26T13:59:21.937132Z', modified='2020-06-26T13:59:21.937132Z', relationship_type='targets', source_ref='malware--315597db-2a74-4a29-8e54-38572e1ac07b', target_ref='identity--a2628104-e357-44a0-b16f-d5f36c0fd0ec')]"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 14,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -685,17 +687,17 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 15,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"data": {
|
"data": {
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"[Relationship(type='relationship', id='relationship--3b9cb248-5c2c-425d-85d0-680bfef6e69d', created='2018-04-05T20:43:54.134Z', modified='2018-04-05T20:43:54.134Z', relationship_type='indicates', source_ref='indicator--61deb2a5-305a-490e-83b3-9839a9677368', target_ref='malware--9fe343d8-edf7-4f4a-bb6c-a221fb75142d'),\n",
|
"[Relationship(type='relationship', spec_version='2.1', id='relationship--ef837187-773c-41e4-ae86-c66189a832f5', created='2020-06-26T13:59:21.929336Z', modified='2020-06-26T13:59:21.929336Z', relationship_type='indicates', source_ref='indicator--9f10f6f2-b93d-488e-be35-72c3ec1087c3', target_ref='malware--315597db-2a74-4a29-8e54-38572e1ac07b'),\n",
|
||||||
" Relationship(type='relationship', id='relationship--93e5afe0-d1fb-4315-8d08-10951f7a99b6', created='2018-04-05T20:43:54.134Z', modified='2018-04-05T20:43:54.134Z', relationship_type='uses', source_ref='campaign--edfd885c-bc31-4051-9bc2-08e057542d56', target_ref='malware--9fe343d8-edf7-4f4a-bb6c-a221fb75142d')]"
|
" Relationship(type='relationship', spec_version='2.1', id='relationship--596c196f-2f05-4584-b643-2186b327a94f', created='2020-06-26T13:59:21.937354Z', modified='2020-06-26T13:59:21.937354Z', relationship_type='uses', source_ref='campaign--d359f872-7e44-4090-8e08-c5bd10bc5f2d', target_ref='malware--315597db-2a74-4a29-8e54-38572e1ac07b')]"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -713,16 +715,16 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 16,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"data": {
|
"data": {
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"[Campaign(type='campaign', id='campaign--edfd885c-bc31-4051-9bc2-08e057542d56', created='2018-04-05T20:43:54.117Z', modified='2018-04-05T20:43:54.117Z', name='Charge', description='Attack!')]"
|
"[Campaign(type='campaign', spec_version='2.1', id='campaign--d359f872-7e44-4090-8e08-c5bd10bc5f2d', created='2020-06-26T13:59:21.923792Z', modified='2020-06-26T13:59:21.923792Z', name='Charge', description='Attack!')]"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 16,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -748,7 +750,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.7"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -67,7 +68,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 1,
|
"execution_count": 3,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -113,7 +114,7 @@
|
||||||
"from stix2 import Indicator\n",
|
"from stix2 import Indicator\n",
|
||||||
"\n",
|
"\n",
|
||||||
"indicator = Indicator(id=\"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7\",\n",
|
"indicator = Indicator(id=\"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"env.add(indicator)"
|
"env.add(indicator)"
|
||||||
]
|
]
|
||||||
|
|
@ -203,14 +204,14 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a740531e-63ff-4e49-a9e1-a0a3eed0e3e7"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:27:53.923Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:08.384618Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:27:53.923Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:08.384618Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:27:53.923548Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:08.384618Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -238,7 +239,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 13,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -258,7 +259,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 14,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -334,15 +335,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--c1b421c0-9c6b-4276-9b73-1b8684a5a0d2"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--4db1493b-8822-4b1c-a471-1c1cdc53ec6d"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:28:48.776Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:36.666866Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:28:48.776Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:36.666866Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:28:48.776442Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:46:36.666866Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -350,14 +351,14 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 14,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"ind = factory.create(Indicator,\n",
|
"ind = factory.create(Indicator,\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"print(ind)"
|
"print(ind)"
|
||||||
]
|
]
|
||||||
|
|
@ -380,7 +381,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 15,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -456,14 +457,14 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--30a3b39c-5f57-4e7f-9eaf-e1abcb643da4"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--e7e92c87-df40-4ffb-a6da-9667b0acddb1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255472Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255472Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:28:53.268567Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:47:58.470047Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -471,7 +472,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 15,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -483,14 +484,14 @@
|
||||||
"\n",
|
"\n",
|
||||||
"ind2 = env2.create(Indicator,\n",
|
"ind2 = env2.create(Indicator,\n",
|
||||||
" created_by_ref=None,\n",
|
" created_by_ref=None,\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"print(ind2)"
|
"print(ind2)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 16,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -566,15 +567,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--6c5bbaaf-6dac-44b0-a0df-86c27b3f6ecb"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--40540b9b-47a7-4855-81a3-b6d3ff6f8592"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--962cabe5-f7f3-438a-9169-585a8c971d12"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--962cabe5-f7f3-438a-9169-585a8c971d12"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255472Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-09-25T18:07:46.255472Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:29:56.55129Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:48:11.028904Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -582,7 +583,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 16,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -590,7 +591,7 @@
|
||||||
"source": [
|
"source": [
|
||||||
"ind3 = env2.create(Indicator,\n",
|
"ind3 = env2.create(Indicator,\n",
|
||||||
" created_by_ref=\"identity--962cabe5-f7f3-438a-9169-585a8c971d12\",\n",
|
" created_by_ref=\"identity--962cabe5-f7f3-438a-9169-585a8c971d12\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"print(ind3)"
|
"print(ind3)"
|
||||||
]
|
]
|
||||||
|
|
@ -606,7 +607,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 17,
|
"execution_count": 13,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -682,15 +683,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--d1b8c3f6-1de1-44c1-b079-3df307224a0d"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--3ab656d1-e549-4a6e-a2df-e84ff515fcd3"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:29:59.605Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:48:20.238719Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:29:59.605Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:48:20.238719Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:29:59.605463Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T14:48:20.238719Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -698,7 +699,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 17,
|
"execution_count": 13,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -708,7 +709,7 @@
|
||||||
" MemoryStore())\n",
|
" MemoryStore())\n",
|
||||||
"\n",
|
"\n",
|
||||||
"i = environ.create(Indicator,\n",
|
"i = environ.create(Indicator,\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"environ.add(i)\n",
|
"environ.add(i)\n",
|
||||||
"print(environ.get(i.id))"
|
"print(environ.get(i.id))"
|
||||||
|
|
@ -731,7 +732,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -167,8 +168,7 @@
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"import stix2\n",
|
"import stix2\n",
|
||||||
"from stix2 import Environment, MemoryStore\n",
|
"from stix2 import AttackPattern, Environment, MemoryStore\n",
|
||||||
"from stix2.v21 import AttackPattern\n",
|
|
||||||
"\n",
|
"\n",
|
||||||
"env = Environment(store=MemoryStore())\n",
|
"env = Environment(store=MemoryStore())\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -291,7 +291,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Campaign\n",
|
"from stix2 import Campaign\n",
|
||||||
"\n",
|
"\n",
|
||||||
"c1 = Campaign(\n",
|
"c1 = Campaign(\n",
|
||||||
" name=\"Someone Attacks Somebody\",)\n",
|
" name=\"Someone Attacks Somebody\",)\n",
|
||||||
|
|
@ -399,7 +399,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Identity\n",
|
"from stix2 import Identity\n",
|
||||||
"\n",
|
"\n",
|
||||||
"id1 = Identity(\n",
|
"id1 = Identity(\n",
|
||||||
" name=\"John Smith\",\n",
|
" name=\"John Smith\",\n",
|
||||||
|
|
@ -645,7 +645,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Location\n",
|
"from stix2 import Location\n",
|
||||||
"\n",
|
"\n",
|
||||||
"loc1 = Location(\n",
|
"loc1 = Location(\n",
|
||||||
" latitude=38.889,\n",
|
" latitude=38.889,\n",
|
||||||
|
|
@ -758,7 +758,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Malware\n",
|
"from stix2 import Malware\n",
|
||||||
"\n",
|
"\n",
|
||||||
"MALWARE_ID = \"malware--9c4638ec-f1de-4ddb-abf4-1b760417654e\"\n",
|
"MALWARE_ID = \"malware--9c4638ec-f1de-4ddb-abf4-1b760417654e\"\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -875,7 +875,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import ThreatActor\n",
|
"from stix2 import ThreatActor\n",
|
||||||
"\n",
|
"\n",
|
||||||
"THREAT_ACTOR_ID = \"threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f\"\n",
|
"THREAT_ACTOR_ID = \"threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f\"\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -992,7 +992,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Tool\n",
|
"from stix2 import Tool\n",
|
||||||
"\n",
|
"\n",
|
||||||
"t1 = Tool(\n",
|
"t1 = Tool(\n",
|
||||||
" tool_types=[\"remote-access\"],\n",
|
" tool_types=[\"remote-access\"],\n",
|
||||||
|
|
@ -1104,7 +1104,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Vulnerability\n",
|
"from stix2 import Vulnerability\n",
|
||||||
"\n",
|
"\n",
|
||||||
"vuln1 = Vulnerability(\n",
|
"vuln1 = Vulnerability(\n",
|
||||||
" name=\"Heartbleed\",\n",
|
" name=\"Heartbleed\",\n",
|
||||||
|
|
@ -1251,7 +1251,7 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2.v21 import Report\n",
|
"from stix2 import Report\n",
|
||||||
"\n",
|
"\n",
|
||||||
"r1 = Report(\n",
|
"r1 = Report(\n",
|
||||||
" report_types=[\"campaign\"],\n",
|
" report_types=[\"campaign\"],\n",
|
||||||
|
|
@ -1422,7 +1422,7 @@
|
||||||
"name": "stderr",
|
"name": "stderr",
|
||||||
"output_type": "stream",
|
"output_type": "stream",
|
||||||
"text": [
|
"text": [
|
||||||
"Starting semantic equivalence process between: 'threat-actor--664624c7-394e-49ad-ae2a-12f7a48a54a3' and 'threat-actor--1d67719e-6be6-4194-9226-1685986514f5'\n",
|
"Starting semantic equivalence process between: 'threat-actor--01538fad-697d-498f-b387-a49cc35de773' and 'threat-actor--dabd290b-6827-4c7f-8dc8-079b6fc83a76'\n",
|
||||||
"--\t\tpartial_string_based 'Evil Org' 'James Bond'\tresult: '11'\n",
|
"--\t\tpartial_string_based 'Evil Org' 'James Bond'\tresult: '11'\n",
|
||||||
"'name' check -- weight: 60, contributing score: 6.6\n",
|
"'name' check -- weight: 60, contributing score: 6.6\n",
|
||||||
"--\t\tpartial_list_based '['crime-syndicate']' '['spy']'\tresult: '0.0'\n",
|
"--\t\tpartial_list_based '['crime-syndicate']' '['spy']'\tresult: '0.0'\n",
|
||||||
|
|
@ -1549,7 +1549,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -1630,7 +1630,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1712,7 +1712,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1794,7 +1794,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1876,7 +1876,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -1958,7 +1958,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2040,7 +2040,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2122,7 +2122,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 18,
|
"execution_count": 17,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -2180,7 +2180,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 19,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -2261,7 +2261,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 19,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2343,7 +2343,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 19,
|
"execution_count": 18,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -2373,7 +2373,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 20,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -2382,7 +2382,7 @@
|
||||||
"9.95"
|
"9.95"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 20,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2464,7 +2464,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 20,
|
"execution_count": 19,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -2492,7 +2492,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 21,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -2573,7 +2573,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 21,
|
"execution_count": 20,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -2610,7 +2610,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 22,
|
"execution_count": 21,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -2691,7 +2691,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 22,
|
"execution_count": 21,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2773,7 +2773,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 22,
|
"execution_count": 21,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -2817,7 +2817,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 23,
|
"execution_count": 22,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -2898,7 +2898,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 23,
|
"execution_count": 22,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -2980,7 +2980,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 23,
|
"execution_count": 22,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -3050,7 +3050,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.8.1"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -126,7 +127,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 4,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -202,25 +203,27 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--00c3bfcb-99bd-4767-8c03-b08f585f5c8a"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--92ec0cbd-2c30-44a2-b270-73f4ec949841"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:33:19.746Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:33:26.565Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:33:19.746Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:33:26.565Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"PowerDuke"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"RTM"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros.[[Citation: Volexity PowerDuke November 2016]]"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"RTM is custom malware written in Delphi. It is used by the group of the same name (RTM).[[Citation: ESET RTM Feb 2017]]"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"malware_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"malware"</span>\n",
|
" <span class=\"s2\">"malware"</span>\n",
|
||||||
" <span class=\"p\">],</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://attack.mitre.org/wiki/Software/S0139"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://attack.mitre.org/wiki/Software/S0148"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"external_id"</span><span class=\"p\">:</span> <span class=\"s2\">"S0139"</span>\n",
|
" <span class=\"nt\">"external_id"</span><span class=\"p\">:</span> <span class=\"s2\">"S0148"</span>\n",
|
||||||
" <span class=\"p\">},</span>\n",
|
" <span class=\"p\">},</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"Volexity PowerDuke November 2016"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"ESET RTM Feb 2017"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017."</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017."</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"</span>\n",
|
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"</span>\n",
|
||||||
" <span class=\"p\">}</span>\n",
|
" <span class=\"p\">}</span>\n",
|
||||||
" <span class=\"p\">],</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
|
|
@ -233,7 +236,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 4,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -245,8 +248,8 @@
|
||||||
"fs = FileSystemStore(\"/tmp/stix2_store\")\n",
|
"fs = FileSystemStore(\"/tmp/stix2_store\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# retrieve STIX2 content from FileSystemStore\n",
|
"# retrieve STIX2 content from FileSystemStore\n",
|
||||||
"ap = fs.get(\"attack-pattern--00d0b012-8a03-410e-95de-5826bf542de6\")\n",
|
"ap = fs.get(\"attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\")\n",
|
||||||
"mal = fs.get(\"malware--00c3bfcb-99bd-4767-8c03-b08f585f5c8a\")\n",
|
"mal = fs.get(\"malware--92ec0cbd-2c30-44a2-b270-73f4ec949841\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# for visual purposes\n",
|
"# for visual purposes\n",
|
||||||
"print(mal)"
|
"print(mal)"
|
||||||
|
|
@ -254,17 +257,14 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 2,
|
"execution_count": 8,
|
||||||
"metadata": {
|
"metadata": {},
|
||||||
"collapsed": true
|
|
||||||
},
|
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2 import ThreatActor, Indicator\n",
|
"from stix2 import ThreatActor, Indicator\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# create new STIX threat-actor\n",
|
"# create new STIX threat-actor\n",
|
||||||
"ta = ThreatActor(name=\"Adjective Bear\",\n",
|
"ta = ThreatActor(name=\"Adjective Bear\",\n",
|
||||||
" labels=[\"nation-state\"],\n",
|
|
||||||
" sophistication=\"innovator\",\n",
|
" sophistication=\"innovator\",\n",
|
||||||
" resource_level=\"government\",\n",
|
" resource_level=\"government\",\n",
|
||||||
" goals=[\n",
|
" goals=[\n",
|
||||||
|
|
@ -275,11 +275,11 @@
|
||||||
"\n",
|
"\n",
|
||||||
"# create new indicators\n",
|
"# create new indicators\n",
|
||||||
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ind1 = Indicator(description=\"Crusades C2 implant 2\",\n",
|
"ind1 = Indicator(description=\"Crusades C2 implant 2\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '64c7e05e40a59511743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '64c7e05e40a59511743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# add STIX object (threat-actor) to FileSystemStore\n",
|
"# add STIX object (threat-actor) to FileSystemStore\n",
|
||||||
|
|
@ -300,7 +300,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 6,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -376,23 +376,34 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"attack-pattern"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"attack-pattern"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"attack-pattern--00d0b012-8a03-410e-95de-5826bf542de6"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:54.176Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:19.735Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:54.176Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:19.735Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Indicator Removal from Tools"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Credential Dumping"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"If a malicious...command-line parameters, Process monitoring"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Credential dumping is the process of obtaining account login and password information from the operating system and software. Credentials can be used to perform Windows Credential Editor, Mimikatz, and gsecdump. These tools are in use by both professional security testers and adversaries.\\n\\nPlaintext passwords can be obtained using tools such as Mimikatz to extract passwords stored by the Local Security Authority (LSA). If smart cards are used to authenticate to a domain using a personal identification number (PIN), then that PIN is also cached as a result and may be dumped.Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective DLL Injection to reduce potential indicators of malicious activity.\\n\\nNTLM hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised Legitimate Credentials in-use by adversaries may help as well. \\n\\nOn Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.\\n\\nMonitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,[[Citation: Powersploit]] which may require additional logging features to be configured in the operating system to collect necessary information for analysis.\\n\\nPlatforms: Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1\\n\\nData Sources: API monitoring, Process command-line parameters, Process monitoring, PowerShell logs"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"kill_chain_phases"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"kill_chain_phases"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"kill_chain_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"kill_chain_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"phase_name"</span><span class=\"p\">:</span> <span class=\"s2\">"defense-evasion"</span>\n",
|
" <span class=\"nt\">"phase_name"</span><span class=\"p\">:</span> <span class=\"s2\">"credential-access"</span>\n",
|
||||||
" <span class=\"p\">}</span>\n",
|
" <span class=\"p\">}</span>\n",
|
||||||
" <span class=\"p\">],</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"external_references"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"p\">{</span>\n",
|
" <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"mitre-attack"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://attack.mitre.org/wiki/Technique/T1066"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://attack.mitre.org/wiki/Technique/T1003"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"external_id"</span><span class=\"p\">:</span> <span class=\"s2\">"T1066"</span>\n",
|
" <span class=\"nt\">"external_id"</span><span class=\"p\">:</span> <span class=\"s2\">"T1003"</span>\n",
|
||||||
|
" <span class=\"p\">},</span>\n",
|
||||||
|
" <span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"Github Mimikatz Module sekurlsa"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Delpy, B. (2014, September 14). Mimikatz module ~ sekurlsa. Retrieved January 10, 2016."</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa"</span>\n",
|
||||||
|
" <span class=\"p\">},</span>\n",
|
||||||
|
" <span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"source_name"</span><span class=\"p\">:</span> <span class=\"s2\">"Powersploit"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"PowerSploit. (n.d.). Retrieved December 4, 2014."</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"url"</span><span class=\"p\">:</span> <span class=\"s2\">"https://github.com/mattifestation/PowerSploit"</span>\n",
|
||||||
" <span class=\"p\">}</span>\n",
|
" <span class=\"p\">}</span>\n",
|
||||||
" <span class=\"p\">],</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
|
|
@ -405,7 +416,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 6,
|
"execution_count": 9,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -417,7 +428,7 @@
|
||||||
"fs_source = FileSystemSource(\"/tmp/stix2_source\")\n",
|
"fs_source = FileSystemSource(\"/tmp/stix2_source\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# retrieve STIX 2 objects\n",
|
"# retrieve STIX 2 objects\n",
|
||||||
"ap = fs_source.get(\"attack-pattern--00d0b012-8a03-410e-95de-5826bf542de6\")\n",
|
"ap = fs_source.get(\"attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# for visual purposes\n",
|
"# for visual purposes\n",
|
||||||
"print(ap)"
|
"print(ap)"
|
||||||
|
|
@ -425,7 +436,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 7,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -499,14 +510,14 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--96b08451-b27a-4ff6-893f-790e26393a8e\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--92ec0cbd-2c30-44a2-b270-73f4ec949841\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 7,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -588,7 +599,89 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 7,
|
"execution_count": 10,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--96b08451-b27a-4ff6-893f-790e26393a8e\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -670,7 +763,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 7,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -745,14 +838,178 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--92ec0cbd-2c30-44a2-b270-73f4ec949841\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 7,
|
"execution_count": 10,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 10,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -772,7 +1029,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 8,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -853,7 +1110,253 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 8,
|
"execution_count": 11,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 11,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 11,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--6b616fc1-1505-48e3-8b2c-0d19337bff38\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -880,7 +1383,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 10,
|
"execution_count": 13,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -895,11 +1398,11 @@
|
||||||
" aliases=[\"Desert Moon\"])\n",
|
" aliases=[\"Desert Moon\"])\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ind1 = Indicator(description=\"Crusades C2 implant\",\n",
|
"ind1 = Indicator(description=\"Crusades C2 implant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# add Campaign object to FileSystemSink\n",
|
"# add Campaign object to FileSystemSink\n",
|
||||||
|
|
@ -926,7 +1429,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -151,15 +152,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--41a960c7-a6d4-406d-9156-0069cb3bd40d"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:41.222Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--96120abd-f767-4292-b8b0-b739749e03b6"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:41.222Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:55.582226Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:55.582226Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Crusades C2 implant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Crusades C2 implant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:41.222522Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:55.582226Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -180,7 +181,7 @@
|
||||||
"\n",
|
"\n",
|
||||||
"# insert newly created indicator into memory\n",
|
"# insert newly created indicator into memory\n",
|
||||||
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
"ind = Indicator(description=\"Crusades C2 implant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '54b7e05e39a59428743635242e4a867c932140a999f52a1e54fa7ee6a440c73b']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"mem.add(ind)\n",
|
"mem.add(ind)\n",
|
||||||
|
|
@ -267,15 +268,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--ba2a7acb-a3ac-420b-9288-09988aa99408"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.343Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--dd5a0203-356d-415c-a118-fb6b0eae9de0"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.343Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.047811Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.047811Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Crusades stage 2 implant variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Crusades stage 2 implant variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = '31a45e777e4d58b97f4c43e38006f8cd6580ddabc4037905b2fad734712b582c']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = '31a45e777e4d58b97f4c43e38006f8cd6580ddabc4037905b2fad734712b582c']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.343298Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.047811Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -293,12 +294,12 @@
|
||||||
"\n",
|
"\n",
|
||||||
"# add multiple STIX objects into memory\n",
|
"# add multiple STIX objects into memory\n",
|
||||||
"ind2 = Indicator(description=\"Crusades stage 2 implant\",\n",
|
"ind2 = Indicator(description=\"Crusades stage 2 implant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '70fa62fb218dd9d936ee570dbe531dfa4e7c128ff37e6af7a6a6b2485487e50a']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '70fa62fb218dd9d936ee570dbe531dfa4e7c128ff37e6af7a6a6b2485487e50a']\")\n",
|
||||||
"ind3 = Indicator(description=\"Crusades stage 2 implant variant\",\n",
|
"ind3 = Indicator(description=\"Crusades stage 2 implant variant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.'SHA-256' = '31a45e777e4d58b97f4c43e38006f8cd6580ddabc4037905b2fad734712b582c']\")\n",
|
" pattern=\"[file:hashes.'SHA-256' = '31a45e777e4d58b97f4c43e38006f8cd6580ddabc4037905b2fad734712b582c']\")\n",
|
||||||
"mal = Malware(labels=[\"rootkit\"], name= \"Alexios\")\n",
|
"mal = Malware(malware_types=[\"rootkit\"], name=\"Alexios\", is_family=False)\n",
|
||||||
"\n",
|
"\n",
|
||||||
"mem.add([ind2,ind3, mal])\n",
|
"mem.add([ind2,ind3, mal])\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -386,13 +387,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--9e9b87ce-2b2b-455a-8d5b-26384ccc8d52"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.346Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--6cee28b8-4d42-4e72-bd77-ea47897672c0"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.346Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.049244Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.049244Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Alexios"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Alexios"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"malware_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"rootkit"</span>\n",
|
" <span class=\"s2\">"rootkit"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -408,7 +411,7 @@
|
||||||
"source": [
|
"source": [
|
||||||
"from stix2 import Filter\n",
|
"from stix2 import Filter\n",
|
||||||
"\n",
|
"\n",
|
||||||
"mal = mem.query([Filter(\"labels\",\"=\", \"rootkit\")])[0]\n",
|
"mal = mem.query([Filter(\"malware_types\",\"=\", \"rootkit\")])[0]\n",
|
||||||
"print(mal)"
|
"print(mal)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -421,7 +424,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 8,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -497,13 +500,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--9e9b87ce-2b2b-455a-8d5b-26384ccc8d52"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.346Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--6cee28b8-4d42-4e72-bd77-ea47897672c0"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:43.346Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.049244Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:28:58.049244Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Alexios"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Alexios"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"malware_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"rootkit"</span>\n",
|
" <span class=\"s2\">"rootkit"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -511,7 +516,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 8,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -525,7 +530,7 @@
|
||||||
"# load(add) STIX content from json file into MemoryStore\n",
|
"# load(add) STIX content from json file into MemoryStore\n",
|
||||||
"mem_2.load_from_file(\"path_to_target_file.json\")\n",
|
"mem_2.load_from_file(\"path_to_target_file.json\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"report = mem_2.get(\"malware--9e9b87ce-2b2b-455a-8d5b-26384ccc8d52\")\n",
|
"report = mem_2.get(\"malware--6cee28b8-4d42-4e72-bd77-ea47897672c0\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# for visual purposes\n",
|
"# for visual purposes\n",
|
||||||
"print(report)"
|
"print(report)"
|
||||||
|
|
@ -548,7 +553,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -63,7 +64,7 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well.\n",
|
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.parsing.rst#stix2.parsing.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and any cyber observables contained within `observed-data` objects will be parsed as well.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"**Parsing a string**"
|
"**Parsing a string**"
|
||||||
]
|
]
|
||||||
|
|
@ -144,7 +145,7 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.ObservedData'>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v21.sdo.ObservedData'>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
|
|
@ -228,6 +229,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
|
@ -237,6 +239,8 @@
|
||||||
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
" <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"file--5d0833b7-065e-571f-8bf2-657cb9569570"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
" <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n",
|
" <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n",
|
||||||
" <span class=\"p\">}</span>\n",
|
" <span class=\"p\">}</span>\n",
|
||||||
|
|
@ -260,6 +264,7 @@
|
||||||
"input_string = \"\"\"{\n",
|
"input_string = \"\"\"{\n",
|
||||||
" \"type\": \"observed-data\",\n",
|
" \"type\": \"observed-data\",\n",
|
||||||
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
||||||
" \"first_observed\": \"2015-12-21T19:00:00Z\",\n",
|
" \"first_observed\": \"2015-12-21T19:00:00Z\",\n",
|
||||||
|
|
@ -363,7 +368,7 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.Identity'>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v21.sdo.Identity'>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
|
|
@ -447,6 +452,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
|
@ -468,6 +474,7 @@
|
||||||
"input_dict = {\n",
|
"input_dict = {\n",
|
||||||
" \"type\": \"identity\",\n",
|
" \"type\": \"identity\",\n",
|
||||||
" \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n",
|
" \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n",
|
||||||
|
" \"spec_version\": \"2.1\",\n",
|
||||||
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
" \"name\": \"Cole Powers\",\n",
|
" \"name\": \"Cole Powers\",\n",
|
||||||
|
|
@ -488,7 +495,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 5,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -562,14 +569,14 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.CourseOfAction'>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v21.sdo.CourseOfAction'>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 5,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
},
|
},
|
||||||
|
|
@ -646,6 +653,7 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
|
@ -659,13 +667,13 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 5,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"file_handle = open(\"/tmp/stix2_store/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd.json\")\n",
|
"file_handle = open(\"/tmp/stix2_store/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd/20170531213041022744.json\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"obj = parse(file_handle)\n",
|
"obj = parse(file_handle)\n",
|
||||||
"print(type(obj))\n",
|
"print(type(obj))\n",
|
||||||
|
|
@ -683,7 +691,14 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.core.rst#stix2.core.parse). Just supply the keyword argument ``allow_custom=True``. When ``allow_custom`` is specified, [parse()](../api/stix2.core.rst#stix2.core.parse) will attempt to convert the supplied STIX content to known STIX 2 domain objects and/or previously defined [custom STIX 2 objects](custom.ipynb). If the conversion cannot be completed (and ``allow_custom`` is specified), [parse()](../api/stix2.core.rst#stix2.core.parse) will treat the supplied STIX 2 content as valid STIX 2 objects and return them. **Warning: Specifying allow_custom may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom content occurs where the custom content supplied is not valid STIX 2**. This is an axiomatic possibility as the ``stix2`` library cannot guarantee proper processing of unknown custom STIX 2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n",
|
"Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.parsing.rst#stix2.parsing.parse). Just supply the keyword argument ``allow_custom=True``. When ``allow_custom`` is specified, [parse()](../api/stix2.parsing.rst#stix2.parsing.parse) will attempt to convert the supplied STIX content to known STIX 2 domain objects and/or previously defined [custom STIX 2 objects](custom.ipynb). If the conversion cannot be completed (and ``allow_custom`` is specified), [parse()](../api/stix2.parsing.rst#stix2.parsing.parse) will treat the supplied STIX 2 content as valid STIX 2 objects and return them. This is an axiomatic possibility as the ``stix2`` library cannot guarantee proper processing of unknown custom STIX 2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n",
|
||||||
|
"<div class=\"alert alert-warning\">\n",
|
||||||
|
"\n",
|
||||||
|
"**Warning**\n",
|
||||||
|
"\n",
|
||||||
|
"Specifying allow_custom may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom content occurs where the custom content supplied is not valid STIX 2\n",
|
||||||
|
"\n",
|
||||||
|
"</div>\n",
|
||||||
"\n",
|
"\n",
|
||||||
"For examples of parsing STIX 2 objects with custom STIX properties, see [Custom STIX Content: Custom Properties](custom.ipynb#Custom-Properties)\n",
|
"For examples of parsing STIX 2 objects with custom STIX properties, see [Custom STIX Content: Custom Properties](custom.ipynb#Custom-Properties)\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -731,7 +746,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -144,15 +145,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--4336ace8-d985-413a-8e32-f749ba268dc3"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--5e515461-93ad-41a8-a540-4f9d1a098939"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012209Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -169,7 +170,7 @@
|
||||||
"from stix2 import Indicator\n",
|
"from stix2 import Indicator\n",
|
||||||
"\n",
|
"\n",
|
||||||
"indicator = Indicator(name=\"File hash for malware variant\",\n",
|
"indicator = Indicator(name=\"File hash for malware variant\",\n",
|
||||||
" labels=[\"malicious-activity\"],\n",
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"print(str(indicator))"
|
"print(str(indicator))"
|
||||||
|
|
@ -258,7 +259,7 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span><span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span> <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span><span class=\"s2\">"malicious-activity"</span><span class=\"p\">],</span> <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span> <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span> <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--4336ace8-d985-413a-8e32-f749ba268dc3"</span><span class=\"p\">,</span> <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span> <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span> <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012209Z"</span><span class=\"p\">}</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span><span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span> <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span> <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span> <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span> <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span> <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span> <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--5e515461-93ad-41a8-a540-4f9d1a098939"</span><span class=\"p\">,</span> <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span> <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span> <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
|
|
@ -359,15 +360,15 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for malware variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
|
||||||
" <span class=\"p\">],</span>\n",
|
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--4336ace8-d985-413a-8e32-f749ba268dc3"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--5e515461-93ad-41a8-a540-4f9d1a098939"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T20:01:20.012209Z"</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T18:47:20.215931Z"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -408,7 +409,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -4,7 +4,6 @@
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 1,
|
"execution_count": 1,
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"collapsed": true,
|
|
||||||
"nbsphinx": "hidden"
|
"nbsphinx": "hidden"
|
||||||
},
|
},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
|
|
@ -16,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -23,7 +23,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 1,
|
"execution_count": 2,
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"nbsphinx": "hidden"
|
"nbsphinx": "hidden"
|
||||||
},
|
},
|
||||||
|
|
@ -63,7 +63,14 @@
|
||||||
"\n",
|
"\n",
|
||||||
"Imports can be used in different ways depending on the use case and support levels.\n",
|
"Imports can be used in different ways depending on the use case and support levels.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"People who want to support the latest version of STIX 2.X without having to make changes, can implicitly use the latest version:"
|
"People who want to support the latest version of STIX 2 without having to make changes, can implicitly use the latest version:",
|
||||||
|
"<div class=\"alert alert-warning\">\n",
|
||||||
|
"\n",
|
||||||
|
"**Warning**\n",
|
||||||
|
"\n",
|
||||||
|
"The implicit import method can cause the code to break between major releases to support a newer approved committee specification. Therefore, not recommended for large scale applications relying on specific object support.\n",
|
||||||
|
"\n",
|
||||||
|
"</div>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -143,7 +150,7 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"or even,"
|
"or even, (less preferred)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -230,14 +237,14 @@
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"### How parsing works\n",
|
"### How parsing works\n",
|
||||||
"If the ``version`` positional argument is not provided. The library will make the best attempt using the \"spec_version\" property found on a Bundle, SDOs, and SROs.\n",
|
"If the ``version`` positional argument is not provided the library will make the best attempt using the \"spec_version\" property found on a Bundle, SDOs, SCOs, or SROs.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"You can lock your [parse()](../api/stix2.core.rst#stix2.core.parse) method to a specific STIX version by:"
|
"You can lock your [parse()](../api/stix2.parsing.rst#stix2.parsing.parse) method to a specific STIX version by:"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 2,
|
"execution_count": 3,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -329,7 +336,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 2,
|
"execution_count": 3,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -356,7 +363,7 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"Keep in mind that if a 2.1 or higher object is parsed, the operation will fail."
|
"In the example above if a 2.1 or higher object is parsed, the operation will fail."
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -365,31 +372,29 @@
|
||||||
"source": [
|
"source": [
|
||||||
"### How custom content works\n",
|
"### How custom content works\n",
|
||||||
"\n",
|
"\n",
|
||||||
"[CustomObject](../api/v20/stix2.v20.sdo.rst#stix2.v20.sdo.CustomObject), [CustomObservable](../api/v20/stix2.v20.observables.rst#stix2.v20.observables.CustomObservable), [CustomMarking](../api/v20/stix2.v20.common.rst#stix2.v20.common.CustomMarking) and [CustomExtension](../api/v20/stix2.v20.observables.rst#stix2.v20.observables.CustomExtension) must be registered explicitly by STIX version. This is a design decision since properties or requirements may change as the STIX Technical Specification advances.\n",
|
"[CustomObject](../api/v21/stix2.v21.sdo.rst#stix2.v21.sdo.CustomObject), [CustomObservable](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomObservable), [CustomMarking](../api/v21/stix2.v21.common.rst#stix2.v21.common.CustomMarking) and [CustomExtension](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomExtension) must be registered explicitly by STIX version. This is a design decision since properties or requirements may change as the STIX Technical Specification advances.\n",
|
||||||
"\n",
|
"\n",
|
||||||
"You can perform this by:"
|
"You can perform this by:"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": null,
|
"execution_count": 4,
|
||||||
"metadata": {
|
"metadata": {},
|
||||||
"collapsed": true
|
|
||||||
},
|
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"import stix2\n",
|
"import stix2\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# Make my custom observable available in STIX 2.0\n",
|
"# Make my custom observable available in STIX 2.0\n",
|
||||||
"@stix2.v20.CustomObservable('x-new-object-type',\n",
|
"@stix2.v20.CustomObservable('x-new-object-type',\n",
|
||||||
" ((\"prop\", stix2.properties.BooleanProperty())))\n",
|
" [(\"prop\", stix2.properties.BooleanProperty())])\n",
|
||||||
"class NewObject2(object):\n",
|
"class NewObject2(object):\n",
|
||||||
" pass\n",
|
" pass\n",
|
||||||
"\n",
|
"\n",
|
||||||
"\n",
|
"\n",
|
||||||
"# Make my custom observable available in STIX 2.1\n",
|
"# Make my custom observable available in STIX 2.1\n",
|
||||||
"@stix2.v21.CustomObservable('x-new-object-type',\n",
|
"@stix2.v21.CustomObservable('x-new-object-type',\n",
|
||||||
" ((\"prop\", stix2.properties.BooleanProperty())))\n",
|
" [(\"prop\", stix2.properties.BooleanProperty())])\n",
|
||||||
"class NewObject2(object):\n",
|
"class NewObject2(object):\n",
|
||||||
" pass"
|
" pass"
|
||||||
]
|
]
|
||||||
|
|
@ -411,7 +416,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -63,12 +64,12 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"To create a new version of an existing object, specify the property(ies) you want to change and their new values. For example, here we change the label from \"anomalous-activity\" to \"malicious-activity\":"
|
"To create a new version of an existing object, specify the property(ies) you want to change and their new values. For example, here we change the indicator type from \"anomalous-activity\" to \"malicious-activity\":"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 3,
|
"execution_count": 4,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -144,13 +145,19 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--8ad18fc7-457c-475d-b292-1ec44febe0fd"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:34.815Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:27:20.792845Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for Foobar malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for Foobar malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"A file indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"A file indicator"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
|
" <span class=\"s2\">"anomalous-activity"</span>\n",
|
||||||
|
" <span class=\"p\">],</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:34.779826Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:27:20.759788Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"malicious-activity"</span>\n",
|
" <span class=\"s2\">"malicious-activity"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">]</span>\n",
|
||||||
|
|
@ -161,7 +168,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 3,
|
"execution_count": 4,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -172,7 +179,8 @@
|
||||||
"indicator = Indicator(created=\"2016-01-01T08:00:00.000Z\",\n",
|
"indicator = Indicator(created=\"2016-01-01T08:00:00.000Z\",\n",
|
||||||
" name=\"File hash for suspicious file\",\n",
|
" name=\"File hash for suspicious file\",\n",
|
||||||
" description=\"A file indicator\",\n",
|
" description=\"A file indicator\",\n",
|
||||||
" labels=[\"anomalous-activity\"],\n",
|
" indicator_types=[\"anomalous-activity\"],\n",
|
||||||
|
" pattern_type=\"stix\",\n",
|
||||||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"\n",
|
"\n",
|
||||||
"indicator2 = indicator.new_version(name=\"File hash for Foobar malware\",\n",
|
"indicator2 = indicator.new_version(name=\"File hash for Foobar malware\",\n",
|
||||||
|
|
@ -189,7 +197,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 4,
|
"execution_count": 5,
|
||||||
"metadata": {
|
"metadata": {
|
||||||
"scrolled": true
|
"scrolled": true
|
||||||
},
|
},
|
||||||
|
|
@ -216,7 +224,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 5,
|
"execution_count": 6,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -292,15 +300,18 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--8ad18fc7-457c-475d-b292-1ec44febe0fd"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:42.648Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:29:37.055139Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for suspicious file"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for suspicious file"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:34.779826Z"</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
|
||||||
" <span class=\"s2\">"anomalous-activity"</span>\n",
|
" <span class=\"s2\">"anomalous-activity"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:27:20.759788Z"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -308,7 +319,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 5,
|
"execution_count": 6,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -329,7 +340,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 6,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -405,16 +416,19 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--8ad18fc7-457c-475d-b292-1ec44febe0fd"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-01-01T08:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:52.198Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:29:38.943037Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for suspicious file"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for suspicious file"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2019-07-25T17:59:34.779826Z"</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"revoked"</span><span class=\"p\">:</span> <span class=\"kc\">true</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
|
||||||
" <span class=\"s2\">"anomalous-activity"</span>\n",
|
" <span class=\"s2\">"anomalous-activity"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-26T19:27:20.759788Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"revoked"</span><span class=\"p\">:</span> <span class=\"kc\">true</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -422,7 +436,7 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 6,
|
"execution_count": 7,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
|
|
@ -449,7 +463,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -15,6 +15,7 @@
|
||||||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||||||
" exception_only=False, running_compiled_code=False):\n",
|
" exception_only=False, running_compiled_code=False):\n",
|
||||||
" etype, value, tb = sys.exc_info()\n",
|
" etype, value, tb = sys.exc_info()\n",
|
||||||
|
" value.__cause__ = None # suppress chained exceptions\n",
|
||||||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||||||
"\n",
|
"\n",
|
||||||
"ipython.showtraceback = hide_traceback"
|
"ipython.showtraceback = hide_traceback"
|
||||||
|
|
@ -218,7 +219,7 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>indicator--a932fcc6-e032-476c-826f-cb970a5a1ade\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>indicator--cd981c25-8042-4166-8945-51178443bdac\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
|
|
@ -382,7 +383,7 @@
|
||||||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--fdd60b30-b67c-41e3-b0b9-f01faf20d111\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
"text/plain": [
|
"text/plain": [
|
||||||
|
|
@ -480,14 +481,16 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--fdd60b30-b67c-41e3-b0b9-f01faf20d111"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-01-27T13:49:53.997Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-01-27T13:49:53.997Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-01-27T13:49:53.997Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-01-27T13:49:53.997Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
" <span class=\"nt\">"malware_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"s2\">"remote-access-trojan"</span>\n",
|
" <span class=\"s2\">"remote-access-trojan"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">true</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -515,7 +518,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 9,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -591,15 +594,18 @@
|
||||||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a932fcc6-e032-476c-826f-cb970a5a1ade"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--cd981c25-8042-4166-8945-51178443bdac"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for Poison Ivy variant"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"File hash for Poison Ivy variant"</span><span class=\"p\">,</span>\n",
|
||||||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']"</span><span class=\"p\">,</span>\n",
|
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||||||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00Z"</span><span class=\"p\">,</span>\n",
|
|
||||||
" <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
|
||||||
" <span class=\"s2\">"file-hash-watchlist"</span>\n",
|
" <span class=\"s2\">"file-hash-watchlist"</span>\n",
|
||||||
" <span class=\"p\">]</span>\n",
|
" <span class=\"p\">],</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.'SHA-256' = 'ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c']"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2014-05-08T09:00:00Z"</span>\n",
|
||||||
"<span class=\"p\">}</span>\n",
|
"<span class=\"p\">}</span>\n",
|
||||||
"</pre></div>\n"
|
"</pre></div>\n"
|
||||||
],
|
],
|
||||||
|
|
@ -607,13 +613,13 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 9,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"malware = get('malware--fdd60b30-b67c-41e3-b0b9-f01faf20d111')\n",
|
"malware = get('malware--c0931cc6-c75e-47e5-9036-78fabc95d4ec')\n",
|
||||||
"indicator = malware.related(filters=Filter('type', '=', 'indicator'))\n",
|
"indicator = malware.related(filters=Filter('type', '=', 'indicator'))\n",
|
||||||
"print(indicator[0])"
|
"print(indicator[0])"
|
||||||
]
|
]
|
||||||
|
|
@ -629,7 +635,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 10,
|
"execution_count": 11,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -646,7 +652,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 11,
|
"execution_count": 12,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -662,7 +668,7 @@
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 12,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
|
|
@ -743,13 +749,13 @@
|
||||||
"<IPython.core.display.HTML object>"
|
"<IPython.core.display.HTML object>"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"execution_count": 12,
|
"execution_count": 14,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"output_type": "execute_result"
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
"indicator = Indicator(labels=[\"malicious-activity\"], pattern=\"[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
"indicator = Indicator(pattern_type=\"stix\", pattern=\"[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
|
||||||
"save(indicator)\n",
|
"save(indicator)\n",
|
||||||
"\n",
|
"\n",
|
||||||
"indicator_creator = get(indicator.created_by_ref)\n",
|
"indicator_creator = get(indicator.created_by_ref)\n",
|
||||||
|
|
@ -769,7 +775,7 @@
|
||||||
"source": [
|
"source": [
|
||||||
"<div class=\"alert alert-warning\">\n",
|
"<div class=\"alert alert-warning\">\n",
|
||||||
"\n",
|
"\n",
|
||||||
"**Warning:**\n",
|
"**Warning**\n",
|
||||||
"\n",
|
"\n",
|
||||||
"The workbench layer replaces STIX Object classes with special versions of them that use \"wrappers\" to provide extra functionality. Because of this, we recommend that you **either use the workbench layer or the rest of the library, but not both**. In other words, don't import from both ``stix2.workbench`` and any other submodules of ``stix2``.\n",
|
"The workbench layer replaces STIX Object classes with special versions of them that use \"wrappers\" to provide extra functionality. Because of this, we recommend that you **either use the workbench layer or the rest of the library, but not both**. In other words, don't import from both ``stix2.workbench`` and any other submodules of ``stix2``.\n",
|
||||||
"\n",
|
"\n",
|
||||||
|
|
@ -793,7 +799,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.3"
|
"version": "3.9.0a6"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
||||||
|
|
@ -4,23 +4,25 @@
|
||||||
:toctree: api
|
:toctree: api
|
||||||
|
|
||||||
confidence
|
confidence
|
||||||
core
|
|
||||||
datastore
|
datastore
|
||||||
environment
|
environment
|
||||||
exceptions
|
exceptions
|
||||||
markings
|
markings
|
||||||
|
parsing
|
||||||
|
pattern_visitor
|
||||||
patterns
|
patterns
|
||||||
properties
|
properties
|
||||||
utils
|
utils
|
||||||
v20
|
v20
|
||||||
v21
|
v21
|
||||||
|
versioning
|
||||||
workbench
|
workbench
|
||||||
|
|
||||||
"""
|
"""
|
||||||
|
|
||||||
# flake8: noqa
|
# flake8: noqa
|
||||||
|
|
||||||
DEFAULT_VERSION = '2.0' # Default version will always be the latest STIX 2.X version
|
DEFAULT_VERSION = '2.1' # Default version will always be the latest STIX 2.X version
|
||||||
|
|
||||||
from .confidence import scales
|
from .confidence import scales
|
||||||
from .datastore import CompositeDataSource
|
from .datastore import CompositeDataSource
|
||||||
|
|
@ -53,7 +55,7 @@ from .patterns import (
|
||||||
RepeatQualifier, StartStopQualifier, StringConstant, TimestampConstant,
|
RepeatQualifier, StartStopQualifier, StringConstant, TimestampConstant,
|
||||||
WithinQualifier,
|
WithinQualifier,
|
||||||
)
|
)
|
||||||
from .v20 import * # This import will always be the latest STIX 2.X version
|
from .v21 import * # This import will always be the latest STIX 2.X version
|
||||||
from .version import __version__
|
from .version import __version__
|
||||||
from .versioning import new_version, revoke
|
from .versioning import new_version, revoke
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -287,7 +287,7 @@ class TAXIICollectionSource(DataSource):
|
||||||
|
|
||||||
# query TAXII collection
|
# query TAXII collection
|
||||||
try:
|
try:
|
||||||
all_data = self.collection.get_objects(**taxii_filters_dict)['objects']
|
all_data = self.collection.get_objects(**taxii_filters_dict).get('objects', [])
|
||||||
|
|
||||||
# deduplicate data (before filtering as reduces wasted filtering)
|
# deduplicate data (before filtering as reduces wasted filtering)
|
||||||
all_data = deduplicate(all_data)
|
all_data = deduplicate(all_data)
|
||||||
|
|
|
||||||
|
|
@ -200,6 +200,8 @@ class Environment(DataStoreMixin):
|
||||||
Args:
|
Args:
|
||||||
obj1: A stix2 object instance
|
obj1: A stix2 object instance
|
||||||
obj2: A stix2 object instance
|
obj2: A stix2 object instance
|
||||||
|
prop_scores: A dictionary that can hold individual property scores,
|
||||||
|
weights, contributing score, matching score and sum of weights.
|
||||||
weight_dict: A dictionary that can be used to override settings
|
weight_dict: A dictionary that can be used to override settings
|
||||||
in the semantic equivalence process
|
in the semantic equivalence process
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
"""STIX2 Core Objects and Methods."""
|
"""STIX2 Core parsing methods."""
|
||||||
|
|
||||||
import copy
|
import copy
|
||||||
import importlib
|
import importlib
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,5 @@
|
||||||
|
"""STIX2 classes and methods to generate AST from patterns"""
|
||||||
|
|
||||||
import importlib
|
import importlib
|
||||||
import inspect
|
import inspect
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
"""Classes to aid in working with the STIX 2 patterning language."""
|
"""Classes to aid in working with the STIX2 patterning language."""
|
||||||
|
|
||||||
import base64
|
import base64
|
||||||
import binascii
|
import binascii
|
||||||
|
|
|
||||||
|
|
@ -14,7 +14,7 @@ import stix2
|
||||||
from .base import _STIXBase
|
from .base import _STIXBase
|
||||||
from .exceptions import (
|
from .exceptions import (
|
||||||
CustomContentError, DictionaryKeyError, MissingPropertiesError,
|
CustomContentError, DictionaryKeyError, MissingPropertiesError,
|
||||||
MutuallyExclusivePropertiesError,
|
MutuallyExclusivePropertiesError, STIXError,
|
||||||
)
|
)
|
||||||
from .parsing import STIX2_OBJ_MAPS, parse, parse_observable
|
from .parsing import STIX2_OBJ_MAPS, parse, parse_observable
|
||||||
from .utils import _get_dict, get_class_hierarchy_names, parse_into_datetime
|
from .utils import _get_dict, get_class_hierarchy_names, parse_into_datetime
|
||||||
|
|
@ -168,6 +168,13 @@ class Property(object):
|
||||||
|
|
||||||
def __init__(self, required=False, fixed=None, default=None):
|
def __init__(self, required=False, fixed=None, default=None):
|
||||||
self.required = required
|
self.required = required
|
||||||
|
|
||||||
|
if required and default:
|
||||||
|
raise STIXError(
|
||||||
|
"Cant't use 'required' and 'default' together. 'required'"
|
||||||
|
"really means 'the user must provide this.'",
|
||||||
|
)
|
||||||
|
|
||||||
if fixed:
|
if fixed:
|
||||||
self._fixed_value = fixed
|
self._fixed_value = fixed
|
||||||
self.clean = self._default_clean
|
self.clean = self._default_clean
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,346 @@
|
||||||
|
import datetime as dt
|
||||||
|
|
||||||
|
import pytest
|
||||||
|
import pytz
|
||||||
|
|
||||||
|
import stix2
|
||||||
|
from stix2.exceptions import ExtraPropertiesError, STIXError
|
||||||
|
from stix2.properties import (
|
||||||
|
BinaryProperty, BooleanProperty, EmbeddedObjectProperty, EnumProperty,
|
||||||
|
FloatProperty, HexProperty, IntegerProperty, ListProperty, Property,
|
||||||
|
StringProperty, TimestampProperty, TypeProperty,
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def test_property():
|
||||||
|
p = Property()
|
||||||
|
|
||||||
|
assert p.required is False
|
||||||
|
assert p.clean('foo') == 'foo'
|
||||||
|
assert p.clean(3) == 3
|
||||||
|
|
||||||
|
|
||||||
|
def test_basic_clean():
|
||||||
|
class Prop(Property):
|
||||||
|
|
||||||
|
def clean(self, value):
|
||||||
|
if value == 42:
|
||||||
|
return value
|
||||||
|
else:
|
||||||
|
raise ValueError("Must be 42")
|
||||||
|
|
||||||
|
p = Prop()
|
||||||
|
|
||||||
|
assert p.clean(42) == 42
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
p.clean(41)
|
||||||
|
|
||||||
|
|
||||||
|
def test_property_default():
|
||||||
|
class Prop(Property):
|
||||||
|
|
||||||
|
def default(self):
|
||||||
|
return 77
|
||||||
|
|
||||||
|
p = Prop()
|
||||||
|
|
||||||
|
assert p.default() == 77
|
||||||
|
|
||||||
|
|
||||||
|
def test_property_fixed():
|
||||||
|
p = Property(fixed="2.0")
|
||||||
|
|
||||||
|
assert p.clean("2.0")
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
assert p.clean("x") is False
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
assert p.clean(2.0) is False
|
||||||
|
|
||||||
|
assert p.default() == "2.0"
|
||||||
|
assert p.clean(p.default())
|
||||||
|
|
||||||
|
|
||||||
|
def test_property_fixed_and_required():
|
||||||
|
with pytest.raises(STIXError):
|
||||||
|
Property(default=lambda: 3, required=True)
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property():
|
||||||
|
p = ListProperty(StringProperty)
|
||||||
|
|
||||||
|
assert p.clean(['abc', 'xyz'])
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
p.clean([])
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property_property_type_custom():
|
||||||
|
class TestObj(stix2.base._STIXBase):
|
||||||
|
_type = "test"
|
||||||
|
_properties = {
|
||||||
|
"foo": StringProperty(),
|
||||||
|
}
|
||||||
|
p = ListProperty(EmbeddedObjectProperty(type=TestObj))
|
||||||
|
|
||||||
|
objs_custom = [
|
||||||
|
TestObj(foo="abc", bar=123, allow_custom=True),
|
||||||
|
TestObj(foo="xyz"),
|
||||||
|
]
|
||||||
|
|
||||||
|
assert p.clean(objs_custom)
|
||||||
|
|
||||||
|
dicts_custom = [
|
||||||
|
{"foo": "abc", "bar": 123},
|
||||||
|
{"foo": "xyz"},
|
||||||
|
]
|
||||||
|
|
||||||
|
# no opportunity to set allow_custom=True when using dicts
|
||||||
|
with pytest.raises(ExtraPropertiesError):
|
||||||
|
p.clean(dicts_custom)
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property_object_type():
|
||||||
|
class TestObj(stix2.base._STIXBase):
|
||||||
|
_type = "test"
|
||||||
|
_properties = {
|
||||||
|
"foo": StringProperty(),
|
||||||
|
}
|
||||||
|
p = ListProperty(TestObj)
|
||||||
|
|
||||||
|
objs = [TestObj(foo="abc"), TestObj(foo="xyz")]
|
||||||
|
assert p.clean(objs)
|
||||||
|
|
||||||
|
dicts = [{"foo": "abc"}, {"foo": "xyz"}]
|
||||||
|
assert p.clean(dicts)
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property_object_type_custom():
|
||||||
|
class TestObj(stix2.base._STIXBase):
|
||||||
|
_type = "test"
|
||||||
|
_properties = {
|
||||||
|
"foo": StringProperty(),
|
||||||
|
}
|
||||||
|
p = ListProperty(TestObj)
|
||||||
|
|
||||||
|
objs_custom = [
|
||||||
|
TestObj(foo="abc", bar=123, allow_custom=True),
|
||||||
|
TestObj(foo="xyz"),
|
||||||
|
]
|
||||||
|
|
||||||
|
assert p.clean(objs_custom)
|
||||||
|
|
||||||
|
dicts_custom = [
|
||||||
|
{"foo": "abc", "bar": 123},
|
||||||
|
{"foo": "xyz"},
|
||||||
|
]
|
||||||
|
|
||||||
|
# no opportunity to set allow_custom=True when using dicts
|
||||||
|
with pytest.raises(ExtraPropertiesError):
|
||||||
|
p.clean(dicts_custom)
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property_bad_element_type():
|
||||||
|
with pytest.raises(TypeError):
|
||||||
|
ListProperty(1)
|
||||||
|
|
||||||
|
|
||||||
|
def test_list_property_bad_value_type():
|
||||||
|
class TestObj(stix2.base._STIXBase):
|
||||||
|
_type = "test"
|
||||||
|
_properties = {
|
||||||
|
"foo": StringProperty(),
|
||||||
|
}
|
||||||
|
|
||||||
|
list_prop = ListProperty(TestObj)
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
list_prop.clean([1])
|
||||||
|
|
||||||
|
|
||||||
|
def test_string_property():
|
||||||
|
prop = StringProperty()
|
||||||
|
|
||||||
|
assert prop.clean('foobar')
|
||||||
|
assert prop.clean(1)
|
||||||
|
assert prop.clean([1, 2, 3])
|
||||||
|
|
||||||
|
|
||||||
|
def test_type_property():
|
||||||
|
prop = TypeProperty('my-type')
|
||||||
|
|
||||||
|
assert prop.clean('my-type')
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
prop.clean('not-my-type')
|
||||||
|
assert prop.clean(prop.default())
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
2,
|
||||||
|
-1,
|
||||||
|
3.14,
|
||||||
|
False,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_integer_property_valid(value):
|
||||||
|
int_prop = IntegerProperty()
|
||||||
|
assert int_prop.clean(value) is not None
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
-1,
|
||||||
|
-100,
|
||||||
|
-50 * 6,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_integer_property_invalid_min_with_constraints(value):
|
||||||
|
int_prop = IntegerProperty(min=0, max=180)
|
||||||
|
with pytest.raises(ValueError) as excinfo:
|
||||||
|
int_prop.clean(value)
|
||||||
|
assert "minimum value is" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
181,
|
||||||
|
200,
|
||||||
|
50 * 6,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_integer_property_invalid_max_with_constraints(value):
|
||||||
|
int_prop = IntegerProperty(min=0, max=180)
|
||||||
|
with pytest.raises(ValueError) as excinfo:
|
||||||
|
int_prop.clean(value)
|
||||||
|
assert "maximum value is" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
"something",
|
||||||
|
StringProperty(),
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_integer_property_invalid(value):
|
||||||
|
int_prop = IntegerProperty()
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
int_prop.clean(value)
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
2,
|
||||||
|
-1,
|
||||||
|
3.14,
|
||||||
|
False,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_float_property_valid(value):
|
||||||
|
int_prop = FloatProperty()
|
||||||
|
assert int_prop.clean(value) is not None
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
"something",
|
||||||
|
StringProperty(),
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_float_property_invalid(value):
|
||||||
|
int_prop = FloatProperty()
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
int_prop.clean(value)
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
True,
|
||||||
|
False,
|
||||||
|
'True',
|
||||||
|
'False',
|
||||||
|
'true',
|
||||||
|
'false',
|
||||||
|
'TRUE',
|
||||||
|
'FALSE',
|
||||||
|
'T',
|
||||||
|
'F',
|
||||||
|
't',
|
||||||
|
'f',
|
||||||
|
1,
|
||||||
|
0,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_boolean_property_valid(value):
|
||||||
|
bool_prop = BooleanProperty()
|
||||||
|
|
||||||
|
assert bool_prop.clean(value) is not None
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
'abc',
|
||||||
|
['false'],
|
||||||
|
{'true': 'true'},
|
||||||
|
2,
|
||||||
|
-1,
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_boolean_property_invalid(value):
|
||||||
|
bool_prop = BooleanProperty()
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
bool_prop.clean(value)
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
'2017-01-01T12:34:56Z',
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_timestamp_property_valid(value):
|
||||||
|
ts_prop = TimestampProperty()
|
||||||
|
assert ts_prop.clean(value) == dt.datetime(2017, 1, 1, 12, 34, 56, tzinfo=pytz.utc)
|
||||||
|
|
||||||
|
|
||||||
|
def test_timestamp_property_invalid():
|
||||||
|
ts_prop = TimestampProperty()
|
||||||
|
with pytest.raises(TypeError):
|
||||||
|
ts_prop.clean(1)
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
ts_prop.clean("someday sometime")
|
||||||
|
|
||||||
|
|
||||||
|
def test_binary_property():
|
||||||
|
bin_prop = BinaryProperty()
|
||||||
|
|
||||||
|
assert bin_prop.clean("TG9yZW0gSXBzdW0=")
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
bin_prop.clean("foobar")
|
||||||
|
|
||||||
|
|
||||||
|
def test_hex_property():
|
||||||
|
hex_prop = HexProperty()
|
||||||
|
|
||||||
|
assert hex_prop.clean("4c6f72656d20497073756d")
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
hex_prop.clean("foobar")
|
||||||
|
|
||||||
|
|
||||||
|
@pytest.mark.parametrize(
|
||||||
|
"value", [
|
||||||
|
['a', 'b', 'c'],
|
||||||
|
('a', 'b', 'c'),
|
||||||
|
'b',
|
||||||
|
],
|
||||||
|
)
|
||||||
|
def test_enum_property_valid(value):
|
||||||
|
enum_prop = EnumProperty(value)
|
||||||
|
assert enum_prop.clean('b')
|
||||||
|
|
||||||
|
|
||||||
|
def test_enum_property_clean():
|
||||||
|
enum_prop = EnumProperty(['1'])
|
||||||
|
assert enum_prop.clean(1) == '1'
|
||||||
|
|
||||||
|
|
||||||
|
def test_enum_property_invalid():
|
||||||
|
enum_prop = EnumProperty(['a', 'b', 'c'])
|
||||||
|
with pytest.raises(ValueError):
|
||||||
|
enum_prop.clean('z')
|
||||||
|
|
@ -4,12 +4,14 @@ import os
|
||||||
import stix2
|
import stix2
|
||||||
from stix2.workbench import (
|
from stix2.workbench import (
|
||||||
_STIX_VID, AttackPattern, Bundle, Campaign, CourseOfAction,
|
_STIX_VID, AttackPattern, Bundle, Campaign, CourseOfAction,
|
||||||
ExternalReference, File, FileSystemSource, Filter, Identity, Indicator,
|
ExternalReference, File, FileSystemSource, Filter, Grouping, Identity,
|
||||||
IntrusionSet, Malware, MarkingDefinition, NTFSExt, ObservedData,
|
Indicator, Infrastructure, IntrusionSet, Location, Malware,
|
||||||
|
MalwareAnalysis, MarkingDefinition, Note, NTFSExt, ObservedData, Opinion,
|
||||||
Relationship, Report, StatementMarking, ThreatActor, Tool, Vulnerability,
|
Relationship, Report, StatementMarking, ThreatActor, Tool, Vulnerability,
|
||||||
add_data_source, all_versions, attack_patterns, campaigns,
|
add_data_source, all_versions, attack_patterns, campaigns,
|
||||||
courses_of_action, create, get, identities, indicators, intrusion_sets,
|
courses_of_action, create, get, groupings, identities, indicators,
|
||||||
malware, observed_data, query, reports, save, set_default_created,
|
infrastructures, intrusion_sets, locations, malware, malware_analyses,
|
||||||
|
notes, observed_data, opinions, query, reports, save, set_default_created,
|
||||||
set_default_creator, set_default_external_refs,
|
set_default_creator, set_default_external_refs,
|
||||||
set_default_object_marking_refs, threat_actors, tools, vulnerabilities,
|
set_default_object_marking_refs, threat_actors, tools, vulnerabilities,
|
||||||
)
|
)
|
||||||
|
|
@ -35,7 +37,7 @@ def test_workbench_environment():
|
||||||
save(ind)
|
save(ind)
|
||||||
|
|
||||||
resp = get(constants.INDICATOR_ID)
|
resp = get(constants.INDICATOR_ID)
|
||||||
assert resp['labels'][0] == 'malicious-activity'
|
assert resp['indicator_types'][0] == 'malicious-activity'
|
||||||
|
|
||||||
resp = all_versions(constants.INDICATOR_ID)
|
resp = all_versions(constants.INDICATOR_ID)
|
||||||
assert len(resp) == 1
|
assert len(resp) == 1
|
||||||
|
|
@ -77,6 +79,15 @@ def test_workbench_get_all_courses_of_action():
|
||||||
assert resp[0].id == constants.COURSE_OF_ACTION_ID
|
assert resp[0].id == constants.COURSE_OF_ACTION_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_groupings():
|
||||||
|
grup = Grouping(id=constants.GROUPING_ID, **constants.GROUPING_KWARGS)
|
||||||
|
save(grup)
|
||||||
|
|
||||||
|
resp = groupings()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.GROUPING_ID
|
||||||
|
|
||||||
|
|
||||||
def test_workbench_get_all_identities():
|
def test_workbench_get_all_identities():
|
||||||
idty = Identity(id=constants.IDENTITY_ID, **constants.IDENTITY_KWARGS)
|
idty = Identity(id=constants.IDENTITY_ID, **constants.IDENTITY_KWARGS)
|
||||||
save(idty)
|
save(idty)
|
||||||
|
|
@ -92,6 +103,15 @@ def test_workbench_get_all_indicators():
|
||||||
assert resp[0].id == constants.INDICATOR_ID
|
assert resp[0].id == constants.INDICATOR_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_infrastructures():
|
||||||
|
inf = Infrastructure(id=constants.INFRASTRUCTURE_ID, **constants.INFRASTRUCTURE_KWARGS)
|
||||||
|
save(inf)
|
||||||
|
|
||||||
|
resp = infrastructures()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.INFRASTRUCTURE_ID
|
||||||
|
|
||||||
|
|
||||||
def test_workbench_get_all_intrusion_sets():
|
def test_workbench_get_all_intrusion_sets():
|
||||||
ins = IntrusionSet(
|
ins = IntrusionSet(
|
||||||
id=constants.INTRUSION_SET_ID, **constants.INTRUSION_SET_KWARGS
|
id=constants.INTRUSION_SET_ID, **constants.INTRUSION_SET_KWARGS
|
||||||
|
|
@ -103,6 +123,15 @@ def test_workbench_get_all_intrusion_sets():
|
||||||
assert resp[0].id == constants.INTRUSION_SET_ID
|
assert resp[0].id == constants.INTRUSION_SET_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_locations():
|
||||||
|
loc = Location(id=constants.LOCATION_ID, **constants.LOCATION_KWARGS)
|
||||||
|
save(loc)
|
||||||
|
|
||||||
|
resp = locations()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.LOCATION_ID
|
||||||
|
|
||||||
|
|
||||||
def test_workbench_get_all_malware():
|
def test_workbench_get_all_malware():
|
||||||
mal = Malware(id=constants.MALWARE_ID, **constants.MALWARE_KWARGS)
|
mal = Malware(id=constants.MALWARE_ID, **constants.MALWARE_KWARGS)
|
||||||
save(mal)
|
save(mal)
|
||||||
|
|
@ -112,6 +141,24 @@ def test_workbench_get_all_malware():
|
||||||
assert resp[0].id == constants.MALWARE_ID
|
assert resp[0].id == constants.MALWARE_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_malware_analyses():
|
||||||
|
mal = MalwareAnalysis(id=constants.MALWARE_ANALYSIS_ID, **constants.MALWARE_ANALYSIS_KWARGS)
|
||||||
|
save(mal)
|
||||||
|
|
||||||
|
resp = malware_analyses()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.MALWARE_ANALYSIS_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_notes():
|
||||||
|
note = Note(id=constants.NOTE_ID, **constants.NOTE_KWARGS)
|
||||||
|
save(note)
|
||||||
|
|
||||||
|
resp = notes()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.NOTE_ID
|
||||||
|
|
||||||
|
|
||||||
def test_workbench_get_all_observed_data():
|
def test_workbench_get_all_observed_data():
|
||||||
od = ObservedData(
|
od = ObservedData(
|
||||||
id=constants.OBSERVED_DATA_ID, **constants.OBSERVED_DATA_KWARGS
|
id=constants.OBSERVED_DATA_ID, **constants.OBSERVED_DATA_KWARGS
|
||||||
|
|
@ -123,6 +170,15 @@ def test_workbench_get_all_observed_data():
|
||||||
assert resp[0].id == constants.OBSERVED_DATA_ID
|
assert resp[0].id == constants.OBSERVED_DATA_ID
|
||||||
|
|
||||||
|
|
||||||
|
def test_workbench_get_all_opinions():
|
||||||
|
op = Opinion(id=constants.OPINION_ID, **constants.OPINION_KWARGS)
|
||||||
|
save(op)
|
||||||
|
|
||||||
|
resp = opinions()
|
||||||
|
assert len(resp) == 1
|
||||||
|
assert resp[0].id == constants.OPINION_ID
|
||||||
|
|
||||||
|
|
||||||
def test_workbench_get_all_reports():
|
def test_workbench_get_all_reports():
|
||||||
rep = Report(id=constants.REPORT_ID, **constants.REPORT_KWARGS)
|
rep = Report(id=constants.REPORT_ID, **constants.REPORT_KWARGS)
|
||||||
save(rep)
|
save(rep)
|
||||||
|
|
@ -210,6 +266,7 @@ def test_workbench_related():
|
||||||
def test_workbench_related_with_filters():
|
def test_workbench_related_with_filters():
|
||||||
malware = Malware(
|
malware = Malware(
|
||||||
labels=["ransomware"], name="CryptorBit", created_by_ref=constants.IDENTITY_ID,
|
labels=["ransomware"], name="CryptorBit", created_by_ref=constants.IDENTITY_ID,
|
||||||
|
is_family=False,
|
||||||
)
|
)
|
||||||
rel = Relationship(malware.id, 'variant-of', constants.MALWARE_ID)
|
rel = Relationship(malware.id, 'variant-of', constants.MALWARE_ID)
|
||||||
save([malware, rel])
|
save([malware, rel])
|
||||||
|
|
|
||||||
|
|
@ -288,6 +288,18 @@ def test_custom_marking_no_init_2():
|
||||||
assert no2.property1 == 'something'
|
assert no2.property1 == 'something'
|
||||||
|
|
||||||
|
|
||||||
|
def test_register_duplicate_marking():
|
||||||
|
with pytest.raises(DuplicateRegistrationError) as excinfo:
|
||||||
|
@stix2.v20.CustomMarking(
|
||||||
|
'x-new-obj2', [
|
||||||
|
('property1', stix2.properties.StringProperty(required=True)),
|
||||||
|
],
|
||||||
|
)
|
||||||
|
class NewObj2():
|
||||||
|
pass
|
||||||
|
assert "cannot be registered again" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
@stix2.v20.CustomObject(
|
@stix2.v20.CustomObject(
|
||||||
'x-new-type', [
|
'x-new-type', [
|
||||||
('property1', stix2.properties.StringProperty(required=True)),
|
('property1', stix2.properties.StringProperty(required=True)),
|
||||||
|
|
@ -1119,15 +1131,3 @@ def test_register_duplicate_observable_extension():
|
||||||
class NewExtension2():
|
class NewExtension2():
|
||||||
pass
|
pass
|
||||||
assert "cannot be registered again" in str(excinfo.value)
|
assert "cannot be registered again" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
def test_register_duplicate_marking():
|
|
||||||
with pytest.raises(DuplicateRegistrationError) as excinfo:
|
|
||||||
@stix2.v20.CustomMarking(
|
|
||||||
'x-new-obj-2', [
|
|
||||||
('property1', stix2.properties.StringProperty(required=True)),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
class NewObj2():
|
|
||||||
pass
|
|
||||||
assert "cannot be registered again" in str(excinfo.value)
|
|
||||||
|
|
|
||||||
|
|
@ -28,7 +28,7 @@ class MockTAXIICollectionEndpoint(Collection):
|
||||||
def add_objects(self, bundle):
|
def add_objects(self, bundle):
|
||||||
self._verify_can_write()
|
self._verify_can_write()
|
||||||
if isinstance(bundle, six.string_types):
|
if isinstance(bundle, six.string_types):
|
||||||
bundle = json.loads(bundle, encoding='utf-8')
|
bundle = json.loads(bundle)
|
||||||
for object in bundle.get("objects", []):
|
for object in bundle.get("objects", []):
|
||||||
self.objects.append(object)
|
self.objects.append(object)
|
||||||
self.manifests.append(
|
self.manifests.append(
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,5 @@
|
||||||
|
from collections import OrderedDict
|
||||||
|
|
||||||
import pytest
|
import pytest
|
||||||
|
|
||||||
import stix2
|
import stix2
|
||||||
|
|
@ -67,8 +69,12 @@ def test_parse_observable_with_no_version():
|
||||||
|
|
||||||
|
|
||||||
def test_register_marking_with_version():
|
def test_register_marking_with_version():
|
||||||
parsing._register_marking(stix2.v20.TLP_WHITE.__class__, version='2.0')
|
class NewMarking1:
|
||||||
|
_type = 'x-new-marking1'
|
||||||
|
_properties = OrderedDict()
|
||||||
|
|
||||||
|
parsing._register_marking(NewMarking1, version='2.0')
|
||||||
v = 'v20'
|
v = 'v20'
|
||||||
|
|
||||||
assert stix2.v20.TLP_WHITE.definition._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
assert NewMarking1._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
||||||
assert v in str(stix2.v20.TLP_WHITE.__class__)
|
assert v in str(parsing.STIX2_OBJ_MAPS[v]['markings'][NewMarking1._type])
|
||||||
|
|
|
||||||
|
|
@ -6,175 +6,16 @@ import stix2
|
||||||
import stix2.base
|
import stix2.base
|
||||||
from stix2.exceptions import (
|
from stix2.exceptions import (
|
||||||
AtLeastOnePropertyError, CustomContentError, DictionaryKeyError,
|
AtLeastOnePropertyError, CustomContentError, DictionaryKeyError,
|
||||||
ExtraPropertiesError,
|
|
||||||
)
|
)
|
||||||
from stix2.properties import (
|
from stix2.properties import (
|
||||||
BinaryProperty, BooleanProperty, DictionaryProperty,
|
DictionaryProperty, EmbeddedObjectProperty, ExtensionsProperty,
|
||||||
EmbeddedObjectProperty, EnumProperty, ExtensionsProperty, FloatProperty,
|
HashesProperty, IDProperty, ListProperty, ReferenceProperty,
|
||||||
HashesProperty, HexProperty, IDProperty, IntegerProperty, ListProperty,
|
STIXObjectProperty,
|
||||||
Property, ReferenceProperty, STIXObjectProperty, StringProperty,
|
|
||||||
TimestampProperty, TypeProperty,
|
|
||||||
)
|
)
|
||||||
from stix2.v20.common import MarkingProperty
|
from stix2.v20.common import MarkingProperty
|
||||||
|
|
||||||
from . import constants
|
from . import constants
|
||||||
|
|
||||||
|
|
||||||
def test_property():
|
|
||||||
p = Property()
|
|
||||||
|
|
||||||
assert p.required is False
|
|
||||||
assert p.clean('foo') == 'foo'
|
|
||||||
assert p.clean(3) == 3
|
|
||||||
|
|
||||||
|
|
||||||
def test_basic_clean():
|
|
||||||
class Prop(Property):
|
|
||||||
|
|
||||||
def clean(self, value):
|
|
||||||
if value == 42:
|
|
||||||
return value
|
|
||||||
else:
|
|
||||||
raise ValueError("Must be 42")
|
|
||||||
|
|
||||||
p = Prop()
|
|
||||||
|
|
||||||
assert p.clean(42) == 42
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
p.clean(41)
|
|
||||||
|
|
||||||
|
|
||||||
def test_property_default():
|
|
||||||
class Prop(Property):
|
|
||||||
|
|
||||||
def default(self):
|
|
||||||
return 77
|
|
||||||
|
|
||||||
p = Prop()
|
|
||||||
|
|
||||||
assert p.default() == 77
|
|
||||||
|
|
||||||
|
|
||||||
def test_fixed_property():
|
|
||||||
p = Property(fixed="2.0")
|
|
||||||
|
|
||||||
assert p.clean("2.0")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
assert p.clean("x") is False
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
assert p.clean(2.0) is False
|
|
||||||
|
|
||||||
assert p.default() == "2.0"
|
|
||||||
assert p.clean(p.default())
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_property_type():
|
|
||||||
p = ListProperty(StringProperty)
|
|
||||||
|
|
||||||
assert p.clean(['abc', 'xyz'])
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
p.clean([])
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_property_type_custom():
|
|
||||||
class TestObj(stix2.base._STIXBase):
|
|
||||||
_type = "test"
|
|
||||||
_properties = {
|
|
||||||
"foo": StringProperty(),
|
|
||||||
}
|
|
||||||
p = ListProperty(EmbeddedObjectProperty(type=TestObj))
|
|
||||||
|
|
||||||
objs_custom = [
|
|
||||||
TestObj(foo="abc", bar=123, allow_custom=True),
|
|
||||||
TestObj(foo="xyz"),
|
|
||||||
]
|
|
||||||
|
|
||||||
assert p.clean(objs_custom)
|
|
||||||
|
|
||||||
dicts_custom = [
|
|
||||||
{"foo": "abc", "bar": 123},
|
|
||||||
{"foo": "xyz"},
|
|
||||||
]
|
|
||||||
|
|
||||||
# no opportunity to set allow_custom=True when using dicts
|
|
||||||
with pytest.raises(ExtraPropertiesError):
|
|
||||||
p.clean(dicts_custom)
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_object_type():
|
|
||||||
class TestObj(stix2.base._STIXBase):
|
|
||||||
_type = "test"
|
|
||||||
_properties = {
|
|
||||||
"foo": StringProperty(),
|
|
||||||
}
|
|
||||||
p = ListProperty(TestObj)
|
|
||||||
|
|
||||||
objs = [TestObj(foo="abc"), TestObj(foo="xyz")]
|
|
||||||
assert p.clean(objs)
|
|
||||||
|
|
||||||
dicts = [{"foo": "abc"}, {"foo": "xyz"}]
|
|
||||||
assert p.clean(dicts)
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_object_type_custom():
|
|
||||||
class TestObj(stix2.base._STIXBase):
|
|
||||||
_type = "test"
|
|
||||||
_properties = {
|
|
||||||
"foo": StringProperty(),
|
|
||||||
}
|
|
||||||
p = ListProperty(TestObj)
|
|
||||||
|
|
||||||
objs_custom = [
|
|
||||||
TestObj(foo="abc", bar=123, allow_custom=True),
|
|
||||||
TestObj(foo="xyz"),
|
|
||||||
]
|
|
||||||
|
|
||||||
assert p.clean(objs_custom)
|
|
||||||
|
|
||||||
dicts_custom = [
|
|
||||||
{"foo": "abc", "bar": 123},
|
|
||||||
{"foo": "xyz"},
|
|
||||||
]
|
|
||||||
|
|
||||||
# no opportunity to set allow_custom=True when using dicts
|
|
||||||
with pytest.raises(ExtraPropertiesError):
|
|
||||||
p.clean(dicts_custom)
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_bad_element_type():
|
|
||||||
with pytest.raises(TypeError):
|
|
||||||
ListProperty(1)
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property_bad_value_type():
|
|
||||||
class TestObj(stix2.base._STIXBase):
|
|
||||||
_type = "test"
|
|
||||||
_properties = {
|
|
||||||
"foo": StringProperty(),
|
|
||||||
}
|
|
||||||
|
|
||||||
list_prop = ListProperty(TestObj)
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
list_prop.clean([1])
|
|
||||||
|
|
||||||
|
|
||||||
def test_string_property():
|
|
||||||
prop = StringProperty()
|
|
||||||
|
|
||||||
assert prop.clean('foobar')
|
|
||||||
assert prop.clean(1)
|
|
||||||
assert prop.clean([1, 2, 3])
|
|
||||||
|
|
||||||
|
|
||||||
def test_type_property():
|
|
||||||
prop = TypeProperty('my-type')
|
|
||||||
|
|
||||||
assert prop.clean('my-type')
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
prop.clean('not-my-type')
|
|
||||||
assert prop.clean(prop.default())
|
|
||||||
|
|
||||||
|
|
||||||
ID_PROP = IDProperty('my-type', spec_version="2.0")
|
ID_PROP = IDProperty('my-type', spec_version="2.0")
|
||||||
MY_ID = 'my-type--232c9d3f-49fc-4440-bb01-607f638778e7'
|
MY_ID = 'my-type--232c9d3f-49fc-4440-bb01-607f638778e7'
|
||||||
|
|
||||||
|
|
@ -242,123 +83,6 @@ def test_id_property_default():
|
||||||
assert ID_PROP.clean(default) == default
|
assert ID_PROP.clean(default) == default
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
3.14,
|
|
||||||
False,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_valid(value):
|
|
||||||
int_prop = IntegerProperty()
|
|
||||||
assert int_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
-1,
|
|
||||||
-100,
|
|
||||||
-5 * 6,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid_min_with_constraints(value):
|
|
||||||
int_prop = IntegerProperty(min=0, max=180)
|
|
||||||
with pytest.raises(ValueError) as excinfo:
|
|
||||||
int_prop.clean(value)
|
|
||||||
assert "minimum value is" in str(excinfo.value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
181,
|
|
||||||
200,
|
|
||||||
50 * 6,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid_max_with_constraints(value):
|
|
||||||
int_prop = IntegerProperty(min=0, max=180)
|
|
||||||
with pytest.raises(ValueError) as excinfo:
|
|
||||||
int_prop.clean(value)
|
|
||||||
assert "maximum value is" in str(excinfo.value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
"something",
|
|
||||||
StringProperty(),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid(value):
|
|
||||||
int_prop = IntegerProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
int_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
3.14,
|
|
||||||
False,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_float_property_valid(value):
|
|
||||||
int_prop = FloatProperty()
|
|
||||||
assert int_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
"something",
|
|
||||||
StringProperty(),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_float_property_invalid(value):
|
|
||||||
int_prop = FloatProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
int_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
True,
|
|
||||||
False,
|
|
||||||
'True',
|
|
||||||
'False',
|
|
||||||
'true',
|
|
||||||
'false',
|
|
||||||
'TRUE',
|
|
||||||
'FALSE',
|
|
||||||
'T',
|
|
||||||
'F',
|
|
||||||
't',
|
|
||||||
'f',
|
|
||||||
1,
|
|
||||||
0,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_boolean_property_valid(value):
|
|
||||||
bool_prop = BooleanProperty()
|
|
||||||
|
|
||||||
assert bool_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
'abc',
|
|
||||||
['false'],
|
|
||||||
{'true': 'true'},
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_boolean_property_invalid(value):
|
|
||||||
bool_prop = BooleanProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
bool_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
def test_reference_property():
|
def test_reference_property():
|
||||||
ref_prop = ReferenceProperty(valid_types="my-type", spec_version="2.0")
|
ref_prop = ReferenceProperty(valid_types="my-type", spec_version="2.0")
|
||||||
|
|
||||||
|
|
@ -381,40 +105,6 @@ def test_reference_property_specific_type():
|
||||||
"my-type--8a8e8758-f92c-4058-ba38-f061cd42a0cf"
|
"my-type--8a8e8758-f92c-4058-ba38-f061cd42a0cf"
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
'2017-01-01T12:34:56Z',
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_timestamp_property_valid(value):
|
|
||||||
ts_prop = TimestampProperty()
|
|
||||||
assert ts_prop.clean(value) == constants.FAKE_TIME
|
|
||||||
|
|
||||||
|
|
||||||
def test_timestamp_property_invalid():
|
|
||||||
ts_prop = TimestampProperty()
|
|
||||||
with pytest.raises(TypeError):
|
|
||||||
ts_prop.clean(1)
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
ts_prop.clean("someday sometime")
|
|
||||||
|
|
||||||
|
|
||||||
def test_binary_property():
|
|
||||||
bin_prop = BinaryProperty()
|
|
||||||
|
|
||||||
assert bin_prop.clean("TG9yZW0gSXBzdW0=")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
bin_prop.clean("foobar")
|
|
||||||
|
|
||||||
|
|
||||||
def test_hex_property():
|
|
||||||
hex_prop = HexProperty()
|
|
||||||
|
|
||||||
assert hex_prop.clean("4c6f72656d20497073756d")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
hex_prop.clean("foobar")
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
@pytest.mark.parametrize(
|
||||||
"d", [
|
"d", [
|
||||||
{'description': 'something'},
|
{'description': 'something'},
|
||||||
|
|
@ -522,24 +212,6 @@ def test_embedded_property():
|
||||||
emb_prop.clean("string")
|
emb_prop.clean("string")
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
['a', 'b', 'c'],
|
|
||||||
('a', 'b', 'c'),
|
|
||||||
'b',
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_enum_property_valid(value):
|
|
||||||
enum_prop = EnumProperty(value)
|
|
||||||
assert enum_prop.clean('b')
|
|
||||||
|
|
||||||
|
|
||||||
def test_enum_property_invalid():
|
|
||||||
enum_prop = EnumProperty(['a', 'b', 'c'])
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
enum_prop.clean('z')
|
|
||||||
|
|
||||||
|
|
||||||
def test_extension_property_valid():
|
def test_extension_property_valid():
|
||||||
ext_prop = ExtensionsProperty(spec_version="2.0", enclosing_type='file')
|
ext_prop = ExtensionsProperty(spec_version="2.0", enclosing_type='file')
|
||||||
assert ext_prop({
|
assert ext_prop({
|
||||||
|
|
|
||||||
|
|
@ -14,6 +14,7 @@ INFRASTRUCTURE_ID = "infrastructure--3000ae1b-784c-f03d-8abc-0a625b2ff018"
|
||||||
INTRUSION_SET_ID = "intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29"
|
INTRUSION_SET_ID = "intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29"
|
||||||
LOCATION_ID = "location--a6e9345f-5a15-4c29-8bb3-7dcc5d168d64"
|
LOCATION_ID = "location--a6e9345f-5a15-4c29-8bb3-7dcc5d168d64"
|
||||||
MALWARE_ID = "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e"
|
MALWARE_ID = "malware--9c4638ec-f1de-4ddb-abf4-1b760417654e"
|
||||||
|
MALWARE_ANALYSIS_ID = "malware-analysis--b46ee0ad-9443-41c5-a8e3-0fa053262805"
|
||||||
MARKING_DEFINITION_ID = "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
MARKING_DEFINITION_ID = "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||||||
NOTE_ID = "note--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061"
|
NOTE_ID = "note--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061"
|
||||||
OBSERVED_DATA_ID = "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"
|
OBSERVED_DATA_ID = "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"
|
||||||
|
|
@ -102,6 +103,10 @@ INTRUSION_SET_KWARGS = dict(
|
||||||
name="Bobcat Breakin",
|
name="Bobcat Breakin",
|
||||||
)
|
)
|
||||||
|
|
||||||
|
LOCATION_KWARGS = dict(
|
||||||
|
region="africa",
|
||||||
|
)
|
||||||
|
|
||||||
MALWARE_KWARGS = dict(
|
MALWARE_KWARGS = dict(
|
||||||
malware_types=['ransomware'],
|
malware_types=['ransomware'],
|
||||||
name="Cryptolocker",
|
name="Cryptolocker",
|
||||||
|
|
@ -119,6 +124,16 @@ MALWARE_MORE_KWARGS = dict(
|
||||||
is_family=False,
|
is_family=False,
|
||||||
)
|
)
|
||||||
|
|
||||||
|
MALWARE_ANALYSIS_KWARGS = dict(
|
||||||
|
product="microsoft",
|
||||||
|
result="malicious",
|
||||||
|
)
|
||||||
|
|
||||||
|
NOTE_KWARGS = dict(
|
||||||
|
content="Heartbleed",
|
||||||
|
object_refs=[CAMPAIGN_ID],
|
||||||
|
)
|
||||||
|
|
||||||
OBSERVED_DATA_KWARGS = dict(
|
OBSERVED_DATA_KWARGS = dict(
|
||||||
first_observed=FAKE_TIME,
|
first_observed=FAKE_TIME,
|
||||||
last_observed=FAKE_TIME,
|
last_observed=FAKE_TIME,
|
||||||
|
|
@ -131,6 +146,11 @@ OBSERVED_DATA_KWARGS = dict(
|
||||||
},
|
},
|
||||||
)
|
)
|
||||||
|
|
||||||
|
OPINION_KWARGS = dict(
|
||||||
|
opinion="agree",
|
||||||
|
object_refs=[CAMPAIGN_ID],
|
||||||
|
)
|
||||||
|
|
||||||
REPORT_KWARGS = dict(
|
REPORT_KWARGS = dict(
|
||||||
report_types=["campaign"],
|
report_types=["campaign"],
|
||||||
name="Bad Cybercrime",
|
name="Bad Cybercrime",
|
||||||
|
|
|
||||||
|
|
@ -397,6 +397,18 @@ def test_custom_marking_invalid_type_name():
|
||||||
pass # pragma: no cover
|
pass # pragma: no cover
|
||||||
assert "Invalid type name '7x-new-marking':" in str(excinfo.value)
|
assert "Invalid type name '7x-new-marking':" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
|
def test_register_duplicate_marking():
|
||||||
|
with pytest.raises(DuplicateRegistrationError) as excinfo:
|
||||||
|
@stix2.v21.CustomMarking(
|
||||||
|
'x-new-obj', [
|
||||||
|
('property1', stix2.properties.StringProperty(required=True)),
|
||||||
|
],
|
||||||
|
)
|
||||||
|
class NewObj2():
|
||||||
|
pass
|
||||||
|
assert "cannot be registered again" in str(excinfo.value)
|
||||||
|
|
||||||
# Custom Objects
|
# Custom Objects
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1326,15 +1338,3 @@ def test_register_duplicate_observable_extension():
|
||||||
class NewExtension2():
|
class NewExtension2():
|
||||||
pass
|
pass
|
||||||
assert "cannot be registered again" in str(excinfo.value)
|
assert "cannot be registered again" in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
def test_register_duplicate_marking():
|
|
||||||
with pytest.raises(DuplicateRegistrationError) as excinfo:
|
|
||||||
@stix2.v21.CustomMarking(
|
|
||||||
'x-new-obj', [
|
|
||||||
('property1', stix2.properties.StringProperty(required=True)),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
class NewObj2():
|
|
||||||
pass
|
|
||||||
assert "cannot be registered again" in str(excinfo.value)
|
|
||||||
|
|
|
||||||
|
|
@ -28,7 +28,7 @@ class MockTAXIICollectionEndpoint(Collection):
|
||||||
def add_objects(self, bundle):
|
def add_objects(self, bundle):
|
||||||
self._verify_can_write()
|
self._verify_can_write()
|
||||||
if isinstance(bundle, six.string_types):
|
if isinstance(bundle, six.string_types):
|
||||||
bundle = json.loads(bundle, encoding='utf-8')
|
bundle = json.loads(bundle)
|
||||||
for object in bundle.get("objects", []):
|
for object in bundle.get("objects", []):
|
||||||
self.objects.append(object)
|
self.objects.append(object)
|
||||||
self.manifests.append(
|
self.manifests.append(
|
||||||
|
|
|
||||||
|
|
@ -98,8 +98,8 @@ def test_indicator_required_properties():
|
||||||
stix2.v21.Indicator()
|
stix2.v21.Indicator()
|
||||||
|
|
||||||
assert excinfo.value.cls == stix2.v21.Indicator
|
assert excinfo.value.cls == stix2.v21.Indicator
|
||||||
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"]
|
assert excinfo.value.properties == ["pattern", "pattern_type"]
|
||||||
assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type, valid_from)."
|
assert str(excinfo.value) == "No values for required properties for Indicator: (pattern, pattern_type)."
|
||||||
|
|
||||||
|
|
||||||
def test_indicator_required_property_pattern():
|
def test_indicator_required_property_pattern():
|
||||||
|
|
@ -107,7 +107,7 @@ def test_indicator_required_property_pattern():
|
||||||
stix2.v21.Indicator(indicator_types=['malicious-activity'])
|
stix2.v21.Indicator(indicator_types=['malicious-activity'])
|
||||||
|
|
||||||
assert excinfo.value.cls == stix2.v21.Indicator
|
assert excinfo.value.cls == stix2.v21.Indicator
|
||||||
assert excinfo.value.properties == ["pattern", "pattern_type", "valid_from"]
|
assert excinfo.value.properties == ["pattern", "pattern_type"]
|
||||||
|
|
||||||
|
|
||||||
def test_indicator_created_ref_invalid_format():
|
def test_indicator_created_ref_invalid_format():
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,5 @@
|
||||||
|
from collections import OrderedDict
|
||||||
|
|
||||||
import pytest
|
import pytest
|
||||||
|
|
||||||
import stix2
|
import stix2
|
||||||
|
|
@ -64,7 +66,7 @@ def test_parse_observable_with_version():
|
||||||
|
|
||||||
@pytest.mark.xfail(reason="The default version is not 2.1", condition=stix2.DEFAULT_VERSION != "2.1")
|
@pytest.mark.xfail(reason="The default version is not 2.1", condition=stix2.DEFAULT_VERSION != "2.1")
|
||||||
def test_parse_observable_with_no_version():
|
def test_parse_observable_with_no_version():
|
||||||
observable = {"type": "file", "name": "foo.exe"}
|
observable = {"type": "file", "name": "foo.exe", "spec_version": "2.1"}
|
||||||
obs_obj = parsing.parse_observable(observable)
|
obs_obj = parsing.parse_observable(observable)
|
||||||
v = 'v21'
|
v = 'v21'
|
||||||
|
|
||||||
|
|
@ -72,18 +74,26 @@ def test_parse_observable_with_no_version():
|
||||||
|
|
||||||
|
|
||||||
def test_register_marking_with_version():
|
def test_register_marking_with_version():
|
||||||
parsing._register_marking(stix2.v21.TLP_WHITE.__class__, version='2.1')
|
class NewMarking1:
|
||||||
|
_type = 'x-new-marking1'
|
||||||
|
_properties = OrderedDict()
|
||||||
|
|
||||||
|
parsing._register_marking(NewMarking1, version='2.1')
|
||||||
v = 'v21'
|
v = 'v21'
|
||||||
|
|
||||||
assert stix2.v21.TLP_WHITE.definition._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
assert NewMarking1._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
||||||
assert v in str(stix2.v21.TLP_WHITE.__class__)
|
assert v in str(parsing.STIX2_OBJ_MAPS[v]['markings'][NewMarking1._type])
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.xfail(reason="The default version is not 2.1", condition=stix2.DEFAULT_VERSION != "2.1")
|
@pytest.mark.xfail(reason="The default version is not 2.1", condition=stix2.DEFAULT_VERSION != "2.1")
|
||||||
def test_register_marking_with_no_version():
|
def test_register_marking_with_no_version():
|
||||||
# Uses default version (2.0 in this case)
|
# Uses default version (2.1 in this case)
|
||||||
parsing._register_marking(stix2.v21.TLP_WHITE.__class__)
|
class NewMarking2:
|
||||||
|
_type = 'x-new-marking2'
|
||||||
|
_properties = OrderedDict()
|
||||||
|
|
||||||
|
parsing._register_marking(NewMarking2)
|
||||||
v = 'v21'
|
v = 'v21'
|
||||||
|
|
||||||
assert stix2.v21.TLP_WHITE.definition._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
assert NewMarking2._type in parsing.STIX2_OBJ_MAPS[v]['markings']
|
||||||
assert v in str(stix2.v21.TLP_WHITE.__class__)
|
assert v in str(parsing.STIX2_OBJ_MAPS[v]['markings'][NewMarking2._type])
|
||||||
|
|
|
||||||
|
|
@ -5,73 +5,15 @@ from stix2.exceptions import (
|
||||||
AtLeastOnePropertyError, CustomContentError, DictionaryKeyError,
|
AtLeastOnePropertyError, CustomContentError, DictionaryKeyError,
|
||||||
)
|
)
|
||||||
from stix2.properties import (
|
from stix2.properties import (
|
||||||
BinaryProperty, BooleanProperty, DictionaryProperty,
|
DictionaryProperty, EmbeddedObjectProperty, ExtensionsProperty,
|
||||||
EmbeddedObjectProperty, EnumProperty, ExtensionsProperty, FloatProperty,
|
HashesProperty, IDProperty, ListProperty, ReferenceProperty,
|
||||||
HashesProperty, HexProperty, IDProperty, IntegerProperty, ListProperty,
|
StringProperty, TypeProperty,
|
||||||
Property, ReferenceProperty, StringProperty, TimestampProperty,
|
|
||||||
TypeProperty,
|
|
||||||
)
|
)
|
||||||
from stix2.v21.common import MarkingProperty
|
from stix2.v21.common import MarkingProperty
|
||||||
|
|
||||||
from . import constants
|
from . import constants
|
||||||
|
|
||||||
|
|
||||||
def test_property():
|
|
||||||
p = Property()
|
|
||||||
|
|
||||||
assert p.required is False
|
|
||||||
assert p.clean('foo') == 'foo'
|
|
||||||
assert p.clean(3) == 3
|
|
||||||
|
|
||||||
|
|
||||||
def test_basic_clean():
|
|
||||||
class Prop(Property):
|
|
||||||
|
|
||||||
def clean(self, value):
|
|
||||||
if value == 42:
|
|
||||||
return value
|
|
||||||
else:
|
|
||||||
raise ValueError("Must be 42")
|
|
||||||
|
|
||||||
p = Prop()
|
|
||||||
|
|
||||||
assert p.clean(42) == 42
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
p.clean(41)
|
|
||||||
|
|
||||||
|
|
||||||
def test_property_default():
|
|
||||||
class Prop(Property):
|
|
||||||
|
|
||||||
def default(self):
|
|
||||||
return 77
|
|
||||||
|
|
||||||
p = Prop()
|
|
||||||
|
|
||||||
assert p.default() == 77
|
|
||||||
|
|
||||||
|
|
||||||
def test_fixed_property():
|
|
||||||
p = Property(fixed="2.0")
|
|
||||||
|
|
||||||
assert p.clean("2.0")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
assert p.clean("x") is False
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
assert p.clean(2.0) is False
|
|
||||||
|
|
||||||
assert p.default() == "2.0"
|
|
||||||
assert p.clean(p.default())
|
|
||||||
|
|
||||||
|
|
||||||
def test_list_property():
|
|
||||||
p = ListProperty(StringProperty)
|
|
||||||
|
|
||||||
assert p.clean(['abc', 'xyz'])
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
p.clean([])
|
|
||||||
|
|
||||||
|
|
||||||
def test_dictionary_property():
|
def test_dictionary_property():
|
||||||
p = DictionaryProperty(StringProperty)
|
p = DictionaryProperty(StringProperty)
|
||||||
|
|
||||||
|
|
@ -161,123 +103,6 @@ def test_id_property_default():
|
||||||
assert ID_PROP.clean(default) == default
|
assert ID_PROP.clean(default) == default
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
3.14,
|
|
||||||
False,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_valid(value):
|
|
||||||
int_prop = IntegerProperty()
|
|
||||||
assert int_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
-1,
|
|
||||||
-100,
|
|
||||||
-50 * 6,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid_min_with_constraints(value):
|
|
||||||
int_prop = IntegerProperty(min=0, max=180)
|
|
||||||
with pytest.raises(ValueError) as excinfo:
|
|
||||||
int_prop.clean(value)
|
|
||||||
assert "minimum value is" in str(excinfo.value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
181,
|
|
||||||
200,
|
|
||||||
50 * 6,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid_max_with_constraints(value):
|
|
||||||
int_prop = IntegerProperty(min=0, max=180)
|
|
||||||
with pytest.raises(ValueError) as excinfo:
|
|
||||||
int_prop.clean(value)
|
|
||||||
assert "maximum value is" in str(excinfo.value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
"something",
|
|
||||||
StringProperty(),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_integer_property_invalid(value):
|
|
||||||
int_prop = IntegerProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
int_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
3.14,
|
|
||||||
False,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_float_property_valid(value):
|
|
||||||
int_prop = FloatProperty()
|
|
||||||
assert int_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
"something",
|
|
||||||
StringProperty(),
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_float_property_invalid(value):
|
|
||||||
int_prop = FloatProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
int_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
True,
|
|
||||||
False,
|
|
||||||
'True',
|
|
||||||
'False',
|
|
||||||
'true',
|
|
||||||
'false',
|
|
||||||
'TRUE',
|
|
||||||
'FALSE',
|
|
||||||
'T',
|
|
||||||
'F',
|
|
||||||
't',
|
|
||||||
'f',
|
|
||||||
1,
|
|
||||||
0,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_boolean_property_valid(value):
|
|
||||||
bool_prop = BooleanProperty()
|
|
||||||
|
|
||||||
assert bool_prop.clean(value) is not None
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
'abc',
|
|
||||||
['false'],
|
|
||||||
{'true': 'true'},
|
|
||||||
2,
|
|
||||||
-1,
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_boolean_property_invalid(value):
|
|
||||||
bool_prop = BooleanProperty()
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
bool_prop.clean(value)
|
|
||||||
|
|
||||||
|
|
||||||
def test_reference_property():
|
def test_reference_property():
|
||||||
ref_prop = ReferenceProperty(valid_types="my-type", spec_version="2.1")
|
ref_prop = ReferenceProperty(valid_types="my-type", spec_version="2.1")
|
||||||
|
|
||||||
|
|
@ -300,40 +125,6 @@ def test_reference_property_specific_type():
|
||||||
"my-type--8a8e8758-f92c-4058-ba38-f061cd42a0cf"
|
"my-type--8a8e8758-f92c-4058-ba38-f061cd42a0cf"
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
'2017-01-01T12:34:56Z',
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_timestamp_property_valid(value):
|
|
||||||
ts_prop = TimestampProperty()
|
|
||||||
assert ts_prop.clean(value) == constants.FAKE_TIME
|
|
||||||
|
|
||||||
|
|
||||||
def test_timestamp_property_invalid():
|
|
||||||
ts_prop = TimestampProperty()
|
|
||||||
with pytest.raises(TypeError):
|
|
||||||
ts_prop.clean(1)
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
ts_prop.clean("someday sometime")
|
|
||||||
|
|
||||||
|
|
||||||
def test_binary_property():
|
|
||||||
bin_prop = BinaryProperty()
|
|
||||||
|
|
||||||
assert bin_prop.clean("TG9yZW0gSXBzdW0=")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
bin_prop.clean("foobar")
|
|
||||||
|
|
||||||
|
|
||||||
def test_hex_property():
|
|
||||||
hex_prop = HexProperty()
|
|
||||||
|
|
||||||
assert hex_prop.clean("4c6f72656d20497073756d")
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
hex_prop.clean("foobar")
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
@pytest.mark.parametrize(
|
||||||
"d", [
|
"d", [
|
||||||
{'description': 'something'},
|
{'description': 'something'},
|
||||||
|
|
@ -452,29 +243,6 @@ def test_embedded_property():
|
||||||
emb_prop.clean("string")
|
emb_prop.clean("string")
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize(
|
|
||||||
"value", [
|
|
||||||
['a', 'b', 'c'],
|
|
||||||
('a', 'b', 'c'),
|
|
||||||
'b',
|
|
||||||
],
|
|
||||||
)
|
|
||||||
def test_enum_property_valid(value):
|
|
||||||
enum_prop = EnumProperty(value)
|
|
||||||
assert enum_prop.clean('b')
|
|
||||||
|
|
||||||
|
|
||||||
def test_enum_property_clean():
|
|
||||||
enum_prop = EnumProperty(['1'])
|
|
||||||
assert enum_prop.clean(1) == '1'
|
|
||||||
|
|
||||||
|
|
||||||
def test_enum_property_invalid():
|
|
||||||
enum_prop = EnumProperty(['a', 'b', 'c'])
|
|
||||||
with pytest.raises(ValueError):
|
|
||||||
enum_prop.clean('z')
|
|
||||||
|
|
||||||
|
|
||||||
def test_extension_property_valid():
|
def test_extension_property_valid():
|
||||||
ext_prop = ExtensionsProperty(spec_version='2.1', enclosing_type='file')
|
ext_prop = ExtensionsProperty(spec_version='2.1', enclosing_type='file')
|
||||||
assert ext_prop({
|
assert ext_prop({
|
||||||
|
|
|
||||||
|
|
@ -40,7 +40,7 @@ class ExternalReference(_STIXBase20):
|
||||||
('source_name', StringProperty(required=True)),
|
('source_name', StringProperty(required=True)),
|
||||||
('description', StringProperty()),
|
('description', StringProperty()),
|
||||||
('url', StringProperty()),
|
('url', StringProperty()),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
('external_id', StringProperty()),
|
('external_id', StringProperty()),
|
||||||
])
|
])
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -30,7 +30,7 @@ class Artifact(_Observable):
|
||||||
('mime_type', StringProperty()),
|
('mime_type', StringProperty()),
|
||||||
('payload_bin', BinaryProperty()),
|
('payload_bin', BinaryProperty()),
|
||||||
('url', StringProperty()),
|
('url', StringProperty()),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
('extensions', ExtensionsProperty(spec_version="2.0", enclosing_type=_type)),
|
('extensions', ExtensionsProperty(spec_version="2.0", enclosing_type=_type)),
|
||||||
])
|
])
|
||||||
|
|
||||||
|
|
@ -173,7 +173,7 @@ class AlternateDataStream(_STIXBase20):
|
||||||
|
|
||||||
_properties = OrderedDict([
|
_properties = OrderedDict([
|
||||||
('name', StringProperty(required=True)),
|
('name', StringProperty(required=True)),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
('size', IntegerProperty()),
|
('size', IntegerProperty()),
|
||||||
])
|
])
|
||||||
|
|
||||||
|
|
@ -256,7 +256,7 @@ class WindowsPEOptionalHeaderType(_STIXBase20):
|
||||||
('size_of_heap_commit', IntegerProperty()),
|
('size_of_heap_commit', IntegerProperty()),
|
||||||
('loader_flags_hex', HexProperty()),
|
('loader_flags_hex', HexProperty()),
|
||||||
('number_of_rva_and_sizes', IntegerProperty()),
|
('number_of_rva_and_sizes', IntegerProperty()),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
])
|
])
|
||||||
|
|
||||||
def _check_object_constraints(self):
|
def _check_object_constraints(self):
|
||||||
|
|
@ -273,7 +273,7 @@ class WindowsPESection(_STIXBase20):
|
||||||
('name', StringProperty(required=True)),
|
('name', StringProperty(required=True)),
|
||||||
('size', IntegerProperty()),
|
('size', IntegerProperty()),
|
||||||
('entropy', FloatProperty()),
|
('entropy', FloatProperty()),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
])
|
])
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -293,7 +293,7 @@ class WindowsPEBinaryExt(_Extension):
|
||||||
('number_of_symbols', IntegerProperty()),
|
('number_of_symbols', IntegerProperty()),
|
||||||
('size_of_optional_header', IntegerProperty()),
|
('size_of_optional_header', IntegerProperty()),
|
||||||
('characteristics_hex', HexProperty()),
|
('characteristics_hex', HexProperty()),
|
||||||
('file_header_hashes', HashesProperty()),
|
('file_header_hashes', HashesProperty(spec_version='2.0')),
|
||||||
('optional_header', EmbeddedObjectProperty(type=WindowsPEOptionalHeaderType)),
|
('optional_header', EmbeddedObjectProperty(type=WindowsPEOptionalHeaderType)),
|
||||||
('sections', ListProperty(EmbeddedObjectProperty(type=WindowsPESection))),
|
('sections', ListProperty(EmbeddedObjectProperty(type=WindowsPESection))),
|
||||||
])
|
])
|
||||||
|
|
@ -307,7 +307,7 @@ class File(_Observable):
|
||||||
_type = 'file'
|
_type = 'file'
|
||||||
_properties = OrderedDict([
|
_properties = OrderedDict([
|
||||||
('type', TypeProperty(_type, spec_version='2.0')),
|
('type', TypeProperty(_type, spec_version='2.0')),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
('size', IntegerProperty()),
|
('size', IntegerProperty()),
|
||||||
('name', StringProperty()),
|
('name', StringProperty()),
|
||||||
('name_enc', StringProperty()),
|
('name_enc', StringProperty()),
|
||||||
|
|
@ -759,7 +759,7 @@ class X509Certificate(_Observable):
|
||||||
_properties = OrderedDict([
|
_properties = OrderedDict([
|
||||||
('type', TypeProperty(_type, spec_version='2.0')),
|
('type', TypeProperty(_type, spec_version='2.0')),
|
||||||
('is_self_signed', BooleanProperty()),
|
('is_self_signed', BooleanProperty()),
|
||||||
('hashes', HashesProperty()),
|
('hashes', HashesProperty(spec_version='2.0')),
|
||||||
('version', StringProperty()),
|
('version', StringProperty()),
|
||||||
('serial_number', StringProperty()),
|
('serial_number', StringProperty()),
|
||||||
('signature_algorithm', StringProperty()),
|
('signature_algorithm', StringProperty()),
|
||||||
|
|
|
||||||
|
|
@ -187,7 +187,7 @@ class Indicator(_DomainObject):
|
||||||
('pattern', PatternProperty(required=True)),
|
('pattern', PatternProperty(required=True)),
|
||||||
('pattern_type', StringProperty(required=True)),
|
('pattern_type', StringProperty(required=True)),
|
||||||
('pattern_version', StringProperty()),
|
('pattern_version', StringProperty()),
|
||||||
('valid_from', TimestampProperty(default=lambda: NOW, required=True)),
|
('valid_from', TimestampProperty(default=lambda: NOW)),
|
||||||
('valid_until', TimestampProperty()),
|
('valid_until', TimestampProperty()),
|
||||||
('kill_chain_phases', ListProperty(KillChainPhase)),
|
('kill_chain_phases', ListProperty(KillChainPhase)),
|
||||||
('revoked', BooleanProperty(default=lambda: False)),
|
('revoked', BooleanProperty(default=lambda: False)),
|
||||||
|
|
@ -204,7 +204,7 @@ class Indicator(_DomainObject):
|
||||||
if kwargs.get('pattern') and kwargs.get('pattern_type') == 'stix' and not kwargs.get('pattern_version'):
|
if kwargs.get('pattern') and kwargs.get('pattern_type') == 'stix' and not kwargs.get('pattern_version'):
|
||||||
kwargs['pattern_version'] = '2.1'
|
kwargs['pattern_version'] = '2.1'
|
||||||
|
|
||||||
super(_DomainObject, self).__init__(*args, **kwargs)
|
super(Indicator, self).__init__(*args, **kwargs)
|
||||||
|
|
||||||
def _check_object_constraints(self):
|
def _check_object_constraints(self):
|
||||||
super(Indicator, self)._check_object_constraints()
|
super(Indicator, self)._check_object_constraints()
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,5 @@
|
||||||
|
"""STIX2 core versioning methods."""
|
||||||
|
|
||||||
import copy
|
import copy
|
||||||
import datetime as dt
|
import datetime as dt
|
||||||
import itertools
|
import itertools
|
||||||
|
|
|
||||||
|
|
@ -25,11 +25,17 @@ import stix2
|
||||||
from . import AttackPattern as _AttackPattern
|
from . import AttackPattern as _AttackPattern
|
||||||
from . import Campaign as _Campaign
|
from . import Campaign as _Campaign
|
||||||
from . import CourseOfAction as _CourseOfAction
|
from . import CourseOfAction as _CourseOfAction
|
||||||
|
from . import Grouping as _Grouping
|
||||||
from . import Identity as _Identity
|
from . import Identity as _Identity
|
||||||
from . import Indicator as _Indicator
|
from . import Indicator as _Indicator
|
||||||
|
from . import Infrastructure as _Infrastructure
|
||||||
from . import IntrusionSet as _IntrusionSet
|
from . import IntrusionSet as _IntrusionSet
|
||||||
|
from . import Location as _Location
|
||||||
from . import Malware as _Malware
|
from . import Malware as _Malware
|
||||||
|
from . import MalwareAnalysis as _MalwareAnalysis
|
||||||
|
from . import Note as _Note
|
||||||
from . import ObservedData as _ObservedData
|
from . import ObservedData as _ObservedData
|
||||||
|
from . import Opinion as _Opinion
|
||||||
from . import Report as _Report
|
from . import Report as _Report
|
||||||
from . import ThreatActor as _ThreatActor
|
from . import ThreatActor as _ThreatActor
|
||||||
from . import Tool as _Tool
|
from . import Tool as _Tool
|
||||||
|
|
@ -40,7 +46,7 @@ from . import ( # noqa: F401
|
||||||
Directory, DomainName, EmailAddress, EmailMessage,
|
Directory, DomainName, EmailAddress, EmailMessage,
|
||||||
EmailMIMEComponent, Environment, ExternalReference, File,
|
EmailMIMEComponent, Environment, ExternalReference, File,
|
||||||
FileSystemSource, Filter, GranularMarking, HTTPRequestExt,
|
FileSystemSource, Filter, GranularMarking, HTTPRequestExt,
|
||||||
ICMPExt, IPv4Address, IPv6Address, KillChainPhase, MACAddress,
|
ICMPExt, IPv4Address, IPv6Address, KillChainPhase, LanguageContent, MACAddress,
|
||||||
MarkingDefinition, MemoryStore, Mutex, NetworkTraffic, NTFSExt,
|
MarkingDefinition, MemoryStore, Mutex, NetworkTraffic, NTFSExt,
|
||||||
parse_observable, PDFExt, Process, RasterImageExt, Relationship,
|
parse_observable, PDFExt, Process, RasterImageExt, Relationship,
|
||||||
Sighting, SocketExt, Software, StatementMarking,
|
Sighting, SocketExt, Software, StatementMarking,
|
||||||
|
|
@ -84,12 +90,13 @@ add_data_sources = _environ.source.add_data_sources
|
||||||
|
|
||||||
|
|
||||||
STIX_OBJS = [
|
STIX_OBJS = [
|
||||||
_AttackPattern, _Campaign, _CourseOfAction, _Identity,
|
_AttackPattern, _Campaign, _CourseOfAction, _Identity, _Grouping,
|
||||||
_Indicator, _IntrusionSet, _Malware, _ObservedData, _Report,
|
_Indicator, _Infrastructure, _IntrusionSet, _Location, _Malware,
|
||||||
|
_MalwareAnalysis, _Note, _ObservedData, _Opinion, _Report,
|
||||||
_ThreatActor, _Tool, _Vulnerability,
|
_ThreatActor, _Tool, _Vulnerability,
|
||||||
]
|
]
|
||||||
|
|
||||||
STIX_OBJ_DOCS = """
|
STIX_OBJ_DOCS = """s
|
||||||
|
|
||||||
.. method:: created_by(*args, **kwargs)
|
.. method:: created_by(*args, **kwargs)
|
||||||
|
|
||||||
|
|
@ -202,6 +209,19 @@ def courses_of_action(filters=None):
|
||||||
return query(filter_list)
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def groupings(filters=None):
|
||||||
|
"""Retrieve all Grouping objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'grouping'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
def identities(filters=None):
|
def identities(filters=None):
|
||||||
"""Retrieve all Identity objects.
|
"""Retrieve all Identity objects.
|
||||||
|
|
||||||
|
|
@ -228,6 +248,19 @@ def indicators(filters=None):
|
||||||
return query(filter_list)
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def infrastructures(filters=None):
|
||||||
|
"""Retrieve all Infrastructure objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'infrastructure'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
def intrusion_sets(filters=None):
|
def intrusion_sets(filters=None):
|
||||||
"""Retrieve all Intrusion Set objects.
|
"""Retrieve all Intrusion Set objects.
|
||||||
|
|
||||||
|
|
@ -241,6 +274,19 @@ def intrusion_sets(filters=None):
|
||||||
return query(filter_list)
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def locations(filters=None):
|
||||||
|
"""Retrieve all Location objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'location'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
def malware(filters=None):
|
def malware(filters=None):
|
||||||
"""Retrieve all Malware objects.
|
"""Retrieve all Malware objects.
|
||||||
|
|
||||||
|
|
@ -254,6 +300,32 @@ def malware(filters=None):
|
||||||
return query(filter_list)
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def malware_analyses(filters=None):
|
||||||
|
"""Retrieve all Malware Analysis objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'malware-analysis'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def notes(filters=None):
|
||||||
|
"""Retrieve all Note objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'note'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
def observed_data(filters=None):
|
def observed_data(filters=None):
|
||||||
"""Retrieve all Observed Data objects.
|
"""Retrieve all Observed Data objects.
|
||||||
|
|
||||||
|
|
@ -267,6 +339,19 @@ def observed_data(filters=None):
|
||||||
return query(filter_list)
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
|
def opinions(filters=None):
|
||||||
|
"""Retrieve all Opinion objects.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
filters (list, optional): A list of additional filters to apply to
|
||||||
|
the query.
|
||||||
|
|
||||||
|
"""
|
||||||
|
filter_list = FilterSet(filters)
|
||||||
|
filter_list.add(Filter('type', '=', 'opinion'))
|
||||||
|
return query(filter_list)
|
||||||
|
|
||||||
|
|
||||||
def reports(filters=None):
|
def reports(filters=None):
|
||||||
"""Retrieve all Report objects.
|
"""Retrieve all Report objects.
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue