docs and tests for parse() mod
=
parent
89cf4bc38f
commit
90834c5b95
|
|
@ -63,21 +63,120 @@
|
||||||
"cell_type": "markdown",
|
"cell_type": "markdown",
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"source": [
|
"source": [
|
||||||
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well."
|
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well.\n",
|
||||||
|
"\n",
|
||||||
|
"**Parsing a string**"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"cell_type": "code",
|
"cell_type": "code",
|
||||||
"execution_count": 3,
|
"execution_count": 10,
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [
|
"outputs": [
|
||||||
{
|
{
|
||||||
"name": "stdout",
|
"name": "stdout",
|
||||||
"output_type": "stream",
|
"output_type": "stream",
|
||||||
"text": [
|
"text": [
|
||||||
"observed-data\n",
|
"<class 'stix2.v20.sdo.ObservedData'>\n"
|
||||||
"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038\n"
|
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"first_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"last_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"number_observed"</span><span class=\"p\">:</span> <span class=\"mi\">50</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n",
|
||||||
|
" <span class=\"p\">}</span>\n",
|
||||||
|
" <span class=\"p\">}</span>\n",
|
||||||
|
" <span class=\"p\">}</span>\n",
|
||||||
|
"<span class=\"p\">}</span>\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 10,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"source": [
|
"source": [
|
||||||
|
|
@ -102,8 +201,292 @@
|
||||||
"}\"\"\"\n",
|
"}\"\"\"\n",
|
||||||
"\n",
|
"\n",
|
||||||
"obj = parse(input_string)\n",
|
"obj = parse(input_string)\n",
|
||||||
"print(obj.type)\n",
|
"print(type(obj))\n",
|
||||||
"print(obj.objects[\"0\"].hashes['SHA-256'])"
|
"print(obj)"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "markdown",
|
||||||
|
"metadata": {},
|
||||||
|
"source": [
|
||||||
|
"**Parsing a dictionary**"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "code",
|
||||||
|
"execution_count": 7,
|
||||||
|
"metadata": {},
|
||||||
|
"outputs": [
|
||||||
|
{
|
||||||
|
"name": "stdout",
|
||||||
|
"output_type": "stream",
|
||||||
|
"text": [
|
||||||
|
"<class 'stix2.v20.sdo.Identity'>\n"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-5473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Cole Powers"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
||||||
|
"<span class=\"p\">}</span>\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 7,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"source": [
|
||||||
|
"input_dict = {\n",
|
||||||
|
" \"type\": \"identity\",\n",
|
||||||
|
" \"id\": \"identity--311b2d2d-f010-5473-83ec-1edf84858f4c\",\n",
|
||||||
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
||||||
|
" \"name\": \"Cole Powers\",\n",
|
||||||
|
" \"identity_class\": \"individual\"\n",
|
||||||
|
"}\n",
|
||||||
|
"\n",
|
||||||
|
"obj = parse(input_dict)\n",
|
||||||
|
"print(type(obj))\n",
|
||||||
|
"print(obj)"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "markdown",
|
||||||
|
"metadata": {},
|
||||||
|
"source": [
|
||||||
|
"**Parsing a file-like object**"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "code",
|
||||||
|
"execution_count": 8,
|
||||||
|
"metadata": {},
|
||||||
|
"outputs": [
|
||||||
|
{
|
||||||
|
"name": "stdout",
|
||||||
|
"output_type": "stream",
|
||||||
|
"text": [
|
||||||
|
"<class 'stix2.v20.sdo.CourseOfAction'>\n"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"text/html": [
|
||||||
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
||||||
|
".highlight { background: #f8f8f8; }\n",
|
||||||
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||||||
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||||||
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||||||
|
".highlight .o { color: #666666 } /* Operator */\n",
|
||||||
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||||||
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||||||
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||||||
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||||||
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||||||
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||||||
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||||||
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||||||
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||||||
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||||||
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||||||
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||||||
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||||||
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||||||
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||||||
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||||||
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||||||
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||||||
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||||||
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||||||
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||||||
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||||||
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||||||
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||||||
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||||||
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||||||
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||||||
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||||||
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||||||
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||||||
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||||||
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||||||
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||||||
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||||||
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||||||
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||||||
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||||||
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||||||
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||||||
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||||||
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||||||
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||||||
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||||||
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||||||
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||||||
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||||||
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||||||
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||||||
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||||||
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||||||
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||||||
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||||||
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||||||
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||||||
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||||||
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||||||
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||||||
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||||||
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||||||
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||||||
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||||||
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||||||
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||||||
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Data from Network Shared Drive Mitigation"</span><span class=\"p\">,</span>\n",
|
||||||
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting[[CiteRef::Beechey 2010]] tools, like AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet Applocker vs SRP]]"</span>\n",
|
||||||
|
"<span class=\"p\">}</span>\n",
|
||||||
|
"</pre></div>\n"
|
||||||
|
],
|
||||||
|
"text/plain": [
|
||||||
|
"<IPython.core.display.HTML object>"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"execution_count": 8,
|
||||||
|
"metadata": {},
|
||||||
|
"output_type": "execute_result"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"source": [
|
||||||
|
"file_handle = open(\"/home/michael/cti-python-stix2/stix2/test/stix2_data/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd.json\")\n",
|
||||||
|
"\n",
|
||||||
|
"obj = parse(file_handle)\n",
|
||||||
|
"print(type(obj))\n",
|
||||||
|
"print(obj)"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "markdown",
|
||||||
|
"metadata": {},
|
||||||
|
"source": [
|
||||||
|
"## Parsing Custom STIX Content"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "markdown",
|
||||||
|
"metadata": {},
|
||||||
|
"source": [
|
||||||
|
"Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.core.rst#stix2.core.parse). Just supply the keyword argument *allow_custom=True*. When *allow_custom* is specified, [parse()](../api/stix2.core.rst#stix2.core.parse) will attempt to convert the supplied STIX content to known STIX2 domain objects and/or previously defined custom defined STIX2 objects. If the conversion cannot be completed (and *allow_custom* is specified), [parse()](../api/stix2.core.rst#stix2.core.parse) will treat the supplied STIX2 content as valid STIX2 objects and return them. **Warning: Specifying *allow_custom* may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom STIX2 content occurs where the custom STIX2 content supplied is not valid STIX2**. This is an axiomatic possibility as the STIX2 library cannot guarantee proper processing of unknown custom STIX2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n",
|
||||||
|
"\n",
|
||||||
|
"For examples on parsing STIX2 objects with custom STIX properties, see [Custom STIX Content:Custom Properties](custom.ipynb#Custom-Properties)\n",
|
||||||
|
"\n",
|
||||||
|
"For examples on parsing defined custom STIX2 objects, see [Custom STIX Content: Custom STIX Object Types](custom.ipynb#Custom-STIX-Object-Types)\n",
|
||||||
|
"\n",
|
||||||
|
"For the case where it is desired to retrieve STIX2 content from a source (e.g. file system, TAXII) that may possibly have custom STIX2 content unknown to the user, the user can create a STIX2 DataStore/Source with the flag *allow_custom=True*. As aforementioned this will configure the DataStore/Source to allow for unknown STIX2 content to be returned (albeit not converted to full STIX2 domain objects and properties); notable processing capabilites of the STIX2 library may be precluded by the unknown STIX2 content, if the content is not valid or actual STIX2 domain objects and properties."
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "code",
|
||||||
|
"execution_count": null,
|
||||||
|
"metadata": {
|
||||||
|
"collapsed": true
|
||||||
|
},
|
||||||
|
"outputs": [],
|
||||||
|
"source": [
|
||||||
|
"from taxii2client import Collection\n",
|
||||||
|
"from stix2 import CompositeDataSource, FileSystemSource, TAXIICollectionSource\n",
|
||||||
|
"\n",
|
||||||
|
"# to allow for the retrieval of unknown custom STIX2 content,\n",
|
||||||
|
"# just create *Stores/*Sources with the 'allow_custom' flag\n",
|
||||||
|
"\n",
|
||||||
|
"# create FileSystemStore\n",
|
||||||
|
"fs = FileSystemSource(\"/path/to/stix2_data/\", allow_custom=True)\n",
|
||||||
|
"\n",
|
||||||
|
"# create TAXIICollectionSource\n",
|
||||||
|
"colxn = Collection('http://taxii_url')\n",
|
||||||
|
"ts = TAXIICollectionSource(colxn, allow_custom=True)\n"
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
|
|
||||||
|
|
@ -73,7 +73,7 @@ STIX2_OBJ_MAPS = {}
|
||||||
|
|
||||||
|
|
||||||
def parse(data, allow_custom=False, version=None):
|
def parse(data, allow_custom=False, version=None):
|
||||||
"""Deserialize a string or file-like object into a STIX object.
|
"""Convert a string, dict or file-like object into a STIX object.
|
||||||
|
|
||||||
Args:
|
Args:
|
||||||
data (str, dict, file-like object): The STIX 2 content to be parsed.
|
data (str, dict, file-like object): The STIX 2 content to be parsed.
|
||||||
|
|
@ -86,6 +86,13 @@ def parse(data, allow_custom=False, version=None):
|
||||||
Returns:
|
Returns:
|
||||||
An instantiated Python STIX object.
|
An instantiated Python STIX object.
|
||||||
|
|
||||||
|
WARNING: 'allow_custom=True' will allow for the return of any supplied STIX
|
||||||
|
dict(s) that cannot be found to map to any known STIX object types (both STIX2
|
||||||
|
domain objects or defined custom STIX2 objects); NO validation is done. This is
|
||||||
|
done to allow the processing of possibly unknown custom STIX objects (example
|
||||||
|
scenario: I need to query a third-party TAXII endpoint that could provide custom
|
||||||
|
STIX objects that I dont know about ahead of time)
|
||||||
|
|
||||||
"""
|
"""
|
||||||
# convert STIX object to dict, if not already
|
# convert STIX object to dict, if not already
|
||||||
obj = get_dict(data)
|
obj = get_dict(data)
|
||||||
|
|
@ -107,6 +114,16 @@ def dict_to_stix2(stix_dict, allow_custom=False, version=None):
|
||||||
custom objects. Note that unknown custom objects cannot be parsed
|
custom objects. Note that unknown custom objects cannot be parsed
|
||||||
into STIX objects, and will be returned as is. Default: False.
|
into STIX objects, and will be returned as is. Default: False.
|
||||||
|
|
||||||
|
Returns:
|
||||||
|
An instantiated Python STIX object
|
||||||
|
|
||||||
|
WARNING: 'allow_custom=True' will allow for the return of any supplied STIX
|
||||||
|
dict(s) that cannot be found to map to any known STIX object types (both STIX2
|
||||||
|
domain objects or defined custom STIX2 objects); NO validation is done. This is
|
||||||
|
done to allow the processing of possibly unknown custom STIX objects (example
|
||||||
|
scenario: I need to query a third-party TAXII endpoint that could provide custom
|
||||||
|
STIX objects that I dont know about ahead of time)
|
||||||
|
|
||||||
"""
|
"""
|
||||||
if not version:
|
if not version:
|
||||||
# Use latest version
|
# Use latest version
|
||||||
|
|
|
||||||
|
|
@ -221,6 +221,20 @@ def test_parse_unregistered_custom_object_type():
|
||||||
assert "use the CustomObject decorator." in str(excinfo.value)
|
assert "use the CustomObject decorator." in str(excinfo.value)
|
||||||
|
|
||||||
|
|
||||||
|
def test_parse_unregistered_custom_object_type_w_allow_custom():
|
||||||
|
"""parse an unknown custom object, allowed by passing
|
||||||
|
'allow_custom' flag
|
||||||
|
"""
|
||||||
|
nt_string = """{
|
||||||
|
"type": "x-foobar-observable",
|
||||||
|
"created": "2015-12-21T19:59:11Z",
|
||||||
|
"property1": "something"
|
||||||
|
}"""
|
||||||
|
|
||||||
|
custom_obj = stix2.parse(nt_string, allow_custom=True)
|
||||||
|
assert custom_obj["type"] == "x-foobar-observable"
|
||||||
|
|
||||||
|
|
||||||
@stix2.observables.CustomObservable('x-new-observable', [
|
@stix2.observables.CustomObservable('x-new-observable', [
|
||||||
('property1', stix2.properties.StringProperty(required=True)),
|
('property1', stix2.properties.StringProperty(required=True)),
|
||||||
('property2', stix2.properties.IntegerProperty()),
|
('property2', stix2.properties.IntegerProperty()),
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue