{ "cells": [ { "cell_type": "code", "execution_count": 1, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# Delete this cell to re-enable tracebacks\n", "import sys\n", "ipython = get_ipython()\n", "\n", "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n", " exception_only=False, running_compiled_code=False):\n", " etype, value, tb = sys.exc_info()\n", " value.__cause__ = None # suppress chained exceptions\n", " return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n", "\n", "ipython.showtraceback = hide_traceback" ] }, { "cell_type": "code", "execution_count": 2, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# JSON output syntax highlighting\n", "from __future__ import print_function\n", "from pygments import highlight\n", "from pygments.lexers import JsonLexer, TextLexer\n", "from pygments.formatters import HtmlFormatter\n", "from IPython.display import display, HTML\n", "from IPython.core.interactiveshell import InteractiveShell\n", "\n", "InteractiveShell.ast_node_interactivity = \"all\"\n", "\n", "def json_print(inpt):\n", " string = str(inpt)\n", " formatter = HtmlFormatter()\n", " if string[0] == '{':\n", " lexer = JsonLexer()\n", " else:\n", " lexer = TextLexer()\n", " return HTML('{}'.format(\n", " formatter.get_style_defs('.highlight'),\n", " highlight(string, lexer, formatter)))\n", "\n", "globals()['print'] = json_print" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## Data Markings" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Creating Objects With Data Markings\n", "\n", "To create an object with a (predefined) TLP marking to an object, just provide it as a keyword argument to the constructor. The TLP markings can easily be imported from python-stix2." ] }, { "cell_type": "code", "execution_count": 3, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
       "    "created": "2021-04-09T13:59:48.911595Z",\n",
       "    "modified": "2021-04-09T13:59:48.911595Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:48.911595Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 3, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Indicator, TLP_AMBER\n", "\n", "indicator = Indicator(pattern_type=\"stix\",\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=TLP_AMBER)\n", "print(indicator.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "If you’re creating your own marking (for example, a ``Statement`` marking), first create the statement marking:" ] }, { "cell_type": "code", "execution_count": 4, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "marking-definition",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
       "    "created": "2021-04-09T13:59:50.587649Z",\n",
       "    "definition_type": "statement",\n",
       "    "definition": {\n",
       "        "statement": "Copyright 2017, Example Corp"\n",
       "    }\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import MarkingDefinition, StatementMarking\n", "\n", "marking_definition = MarkingDefinition( \n", " definition_type=\"statement\", \n", " definition=StatementMarking(statement=\"Copyright 2017, Example Corp\")\n", ")\n", "print(marking_definition.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Then you can add it to an object as it’s being created (passing either full object or the the ID as a keyword argument, like with relationships)." ] }, { "cell_type": "code", "execution_count": 5, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--91ed23a6-c5f0-4b16-8369-64cf39f974bf",\n",
       "    "created": "2021-04-09T13:59:52.602254Z",\n",
       "    "modified": "2021-04-09T13:59:52.602254Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:52.602254Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 5, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator2 = Indicator(pattern_type=\"stix\",\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=marking_definition)\n", "print(indicator2.serialize(pretty=True))" ] }, { "cell_type": "code", "execution_count": 6, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--42ae262e-4839-4c1a-a50a-3a6690623a9d",\n",
       "    "created": "2021-04-09T13:59:54.207797Z",\n",
       "    "modified": "2021-04-09T13:59:54.207797Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:54.207797Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 6, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator3 = Indicator(pattern_type=\"stix\",\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\")\n", "print(indicator3.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Granular markings work in the same way, except you also need to provide a full granular-marking object (including the selector)." ] }, { "cell_type": "code", "execution_count": 7, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "malware",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "malware--2658ac6a-44e9-44ea-8c8a-d67abae4d0d5",\n",
       "    "created": "2021-04-09T13:59:56.556801Z",\n",
       "    "modified": "2021-04-09T13:59:56.556801Z",\n",
       "    "name": "Poison Ivy",\n",
       "    "description": "A ransomware related to ...",\n",
       "    "is_family": false,\n",
       "    "granular_markings": [\n",
       "        {\n",
       "            "marking_ref": "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
       "            "selectors": [\n",
       "                "description"\n",
       "            ]\n",
       "        },\n",
       "        {\n",
       "            "marking_ref": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",\n",
       "            "selectors": [\n",
       "                "name"\n",
       "            ]\n",
       "        }\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 7, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Malware, TLP_WHITE\n", "\n", "malware = Malware(name=\"Poison Ivy\",\n", " description=\"A ransomware related to ...\",\n", " is_family=False,\n", " granular_markings=[\n", " {\n", " \"selectors\": [\"description\"],\n", " \"marking_ref\": marking_definition\n", " },\n", " {\n", " \"selectors\": [\"name\"],\n", " \"marking_ref\": TLP_WHITE\n", " }\n", " ])\n", "print(malware.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Make sure that the selector is a field that exists and is populated on the object, otherwise this will cause an error:" ] }, { "cell_type": "code", "execution_count": 8, "metadata": {}, "outputs": [ { "ename": "InvalidSelectorError", "evalue": "Selector title in Malware is not valid!", "output_type": "error", "traceback": [ "\u001b[0;31mInvalidSelectorError\u001b[0m\u001b[0;31m:\u001b[0m Selector title in Malware is not valid!\n" ] } ], "source": [ "Malware(name=\"Poison Ivy\",\n", " description=\"A ransomware related to ...\",\n", " is_family=False,\n", " granular_markings=[\n", " {\n", " \"selectors\": [\"title\"],\n", " \"marking_ref\": marking_definition\n", " }\n", " ])" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Adding Data Markings To Existing Objects" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "[Several functions](../api/stix2.markings.rst) exist to support working with data markings.\n", "\n", "Both object markings and granular markings can be added to STIX objects which have already been created.\n", "\n", "**Note**: Doing so will create a new version of the object (note the updated ``modified`` time)." ] }, { "cell_type": "code", "execution_count": 9, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
       "    "created": "2021-04-09T13:59:48.911595Z",\n",
       "    "modified": "2021-04-09T14:00:01.165749Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:48.911595Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d",\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 9, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator4 = indicator.add_markings(marking_definition)\n", "print(indicator4.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "You can also remove specific markings from STIX objects. This will also create a new version of the object." ] }, { "cell_type": "code", "execution_count": 10, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
       "    "created": "2021-04-09T13:59:48.911595Z",\n",
       "    "modified": "2021-04-09T14:00:03.00911Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:48.911595Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 10, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator5 = indicator4.remove_markings(marking_definition)\n", "print(indicator5.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "The markings on an object can be replaced with a different set of markings:" ] }, { "cell_type": "code", "execution_count": 11, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
       "    "created": "2021-04-09T13:59:48.911595Z",\n",
       "    "modified": "2021-04-09T14:00:04.531083Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:48.911595Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
       "        "marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 11, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import TLP_GREEN\n", "\n", "indicator6 = indicator5.set_markings([TLP_GREEN, marking_definition])\n", "print(indicator6.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "STIX objects can also be cleared of all markings with [clear_markings()](../api/stix2.markings.rst#stix2.markings.clear_markings):" ] }, { "cell_type": "code", "execution_count": 12, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1",\n",
       "    "created": "2021-04-09T13:59:48.911595Z",\n",
       "    "modified": "2021-04-09T14:00:06.512465Z",\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T13:59:48.911595Z"\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 12, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator7 = indicator5.clear_markings()\n", "print(indicator7.serialize(pretty=True))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "All of these functions can be used for granular markings by passing in a list of selectors. Note that they will create new versions of the objects." ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Evaluating Data Markings\n", "\n", "You can get a list of the object markings on a STIX object:" ] }, { "cell_type": "code", "execution_count": 13, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da',\n", " 'marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d']" ] }, "execution_count": 13, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator6.get_markings()" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "To get a list of the granular markings on an object, pass the object and a list of selectors to [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings):" ] }, { "cell_type": "code", "execution_count": 14, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']" ] }, "execution_count": 14, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import get_markings\n", "\n", "get_markings(malware, 'name')" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "You can also call [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings) as a method on the STIX object." ] }, { "cell_type": "code", "execution_count": 15, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']" ] }, "execution_count": 15, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.get_markings('name')" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Finally, you may also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors." ] }, { "cell_type": "code", "execution_count": 16, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "True" ] }, "execution_count": 16, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator.is_marked(TLP_AMBER.id)" ] }, { "cell_type": "code", "execution_count": 17, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "True" ] }, "execution_count": 17, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.is_marked(TLP_WHITE.id, 'name')" ] }, { "cell_type": "code", "execution_count": 18, "metadata": { "scrolled": true }, "outputs": [ { "data": { "text/plain": [ "False" ] }, "execution_count": 18, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.is_marked(TLP_WHITE.id, 'description')" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "# Extracting Lang Data Markings or marking-definition Data Markings\n", "\n", "If you need a specific kind of marking, you can also filter them using the API. By default the library will get both types of markings by default. You can choose between `lang=True/False` or `marking_ref=True/False` depending on your use-case." ] }, { "cell_type": "code", "execution_count": 19, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
       "    "created": "2021-04-09T14:02:31.991141Z",\n",
       "    "modified": "2021-04-09T14:02:31.991141Z",\n",
       "    "description": "Una descripcion sobre este indicador",\n",
       "    "indicator_types": [\n",
       "        "malware"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T14:02:31.991141Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ],\n",
       "    "granular_markings": [\n",
       "        {\n",
       "            "lang": "es",\n",
       "            "selectors": [\n",
       "                "description"\n",
       "            ]\n",
       "        },\n",
       "        {\n",
       "            "marking_ref": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
       "            "selectors": [\n",
       "                "description"\n",
       "            ]\n",
       "        }\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "
['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da', 'es']\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "
['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "
['es']\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Indicator\n", "\n", "v21_indicator = Indicator(\n", " description=\"Una descripcion sobre este indicador\",\n", " pattern_type=\"stix\",\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=['marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'],\n", " indicator_types=['malware'],\n", " granular_markings=[\n", " {\n", " 'selectors': ['description'],\n", " 'lang': 'es'\n", " },\n", " {\n", " 'selectors': ['description'],\n", " 'marking_ref': 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da'\n", " }\n", " ]\n", ")\n", "print(v21_indicator.serialize(pretty=True))\n", "\n", "# Gets both lang and marking_ref markings for 'description'\n", "print(v21_indicator.get_markings('description'))\n", "\n", "# Exclude lang markings from results\n", "print(v21_indicator.get_markings('description', lang=False))\n", "\n", "# Exclude marking-definition markings from results\n", "print(v21_indicator.get_markings('description', marking_ref=False))" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "In this same manner, calls to `clear_markings` and `set_markings` also have the ability to operate in for one or both types of markings." ] }, { "cell_type": "code", "execution_count": 21, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
       "    "created": "2021-04-09T14:02:31.991141Z",\n",
       "    "modified": "2021-04-09T14:03:11.817032Z",\n",
       "    "description": "Una descripcion sobre este indicador",\n",
       "    "indicator_types": [\n",
       "        "malware"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T14:02:31.991141Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 21, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# By default, both types of markings will be removed\n", "print(v21_indicator.clear_markings(\"description\").serialize(pretty=True))" ] }, { "cell_type": "code", "execution_count": 22, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
       "    "created": "2021-04-09T14:02:31.991141Z",\n",
       "    "modified": "2021-04-09T14:03:24.701927Z",\n",
       "    "description": "Una descripcion sobre este indicador",\n",
       "    "indicator_types": [\n",
       "        "malware"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T14:02:31.991141Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ],\n",
       "    "granular_markings": [\n",
       "        {\n",
       "            "lang": "es",\n",
       "            "selectors": [\n",
       "                "description"\n",
       "            ]\n",
       "        }\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 22, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# If lang is False, no lang markings will be removed\n", "print(v21_indicator.clear_markings(\"description\", lang=False).serialize(pretty=True))" ] }, { "cell_type": "code", "execution_count": 23, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15",\n",
       "    "created": "2021-04-09T14:02:31.991141Z",\n",
       "    "modified": "2021-04-09T14:03:29.751985Z",\n",
       "    "description": "Una descripcion sobre este indicador",\n",
       "    "indicator_types": [\n",
       "        "malware"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2021-04-09T14:02:31.991141Z",\n",
       "    "object_marking_refs": [\n",
       "        "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"\n",
       "    ],\n",
       "    "granular_markings": [\n",
       "        {\n",
       "            "marking_ref": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",\n",
       "            "selectors": [\n",
       "                "description"\n",
       "            ]\n",
       "        }\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 23, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# If marking_ref is False, no marking-definition markings will be removed\n", "print(v21_indicator.clear_markings(\"description\", marking_ref=False).serialize(pretty=True))" ] } ], "metadata": { "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.9.2" } }, "nbformat": 4, "nbformat_minor": 2 }