{ "cells": [ { "cell_type": "code", "execution_count": 1, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# Delete this cell to re-enable tracebacks\n", "import sys\n", "ipython = get_ipython()\n", "\n", "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n", " exception_only=False, running_compiled_code=False):\n", " etype, value, tb = sys.exc_info()\n", " value.__cause__ = None # suppress chained exceptions\n", " return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n", "\n", "ipython.showtraceback = hide_traceback" ] }, { "cell_type": "code", "execution_count": 2, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# JSON output syntax highlighting\n", "from __future__ import print_function\n", "from pygments import highlight\n", "from pygments.lexers import JsonLexer, TextLexer\n", "from pygments.formatters import HtmlFormatter\n", "from IPython.display import display, HTML\n", "from IPython.core.interactiveshell import InteractiveShell\n", "\n", "InteractiveShell.ast_node_interactivity = \"all\"\n", "\n", "def json_print(inpt):\n", " string = str(inpt)\n", " formatter = HtmlFormatter()\n", " if string[0] == '{':\n", " lexer = JsonLexer()\n", " else:\n", " lexer = TextLexer()\n", " return HTML('{}'.format(\n", " formatter.get_style_defs('.highlight'),\n", " highlight(string, lexer, formatter)))\n", "\n", "globals()['print'] = json_print" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## Versioning" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "To create a new version of an existing object, specify the property(ies) you want to change and their new values. For example, here we change the indicator type from \"anomalous-activity\" to \"malicious-activity\":" ] }, { "cell_type": "code", "execution_count": 4, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
       "    "created": "2016-01-01T08:00:00.000Z",\n",
       "    "modified": "2020-06-26T19:27:20.792845Z",\n",
       "    "name": "File hash for Foobar malware",\n",
       "    "description": "A file indicator",\n",
       "    "indicator_types": [\n",
       "        "anomalous-activity"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2020-06-26T19:27:20.759788Z",\n",
       "    "labels": [\n",
       "        "malicious-activity"\n",
       "    ]\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Indicator\n", "\n", "indicator = Indicator(created=\"2016-01-01T08:00:00.000Z\",\n", " name=\"File hash for suspicious file\",\n", " description=\"A file indicator\",\n", " indicator_types=[\"anomalous-activity\"],\n", " pattern_type=\"stix\",\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n", "\n", "indicator2 = indicator.new_version(name=\"File hash for Foobar malware\",\n", " labels=[\"malicious-activity\"])\n", "print(indicator2)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "The modified time will be updated to the current time unless you provide a specific value as a keyword argument. Note that you can’t change the `type`, `id`, or `created` properties." ] }, { "cell_type": "code", "execution_count": 5, "metadata": { "scrolled": true }, "outputs": [ { "ename": "UnmodifiablePropertyError", "evalue": "These properties cannot be changed when making a new version: id.", "output_type": "error", "traceback": [ "\u001b[0;31mUnmodifiablePropertyError\u001b[0m\u001b[0;31m:\u001b[0m These properties cannot be changed when making a new version: id.\n" ] } ], "source": [ "indicator.new_version(id=\"indicator--cc42e358-8b9b-493c-9646-6ecd73b41c21\")" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "You can remove optional or custom properties by setting them to `None` when you call `new_version()`." ] }, { "cell_type": "code", "execution_count": 6, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
       "    "created": "2016-01-01T08:00:00.000Z",\n",
       "    "modified": "2020-06-26T19:29:37.055139Z",\n",
       "    "name": "File hash for suspicious file",\n",
       "    "indicator_types": [\n",
       "        "anomalous-activity"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2020-06-26T19:27:20.759788Z"\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 6, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator3 = indicator.new_version(description=None)\n", "print(indicator3)" ] }, { "cell_type": "markdown", "metadata": { "collapsed": true }, "source": [ "To revoke an object:" ] }, { "cell_type": "code", "execution_count": 7, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
{\n",
       "    "type": "indicator",\n",
       "    "spec_version": "2.1",\n",
       "    "id": "indicator--6a7f1c8a-3c9a-471f-8ef0-e95e51457c3f",\n",
       "    "created": "2016-01-01T08:00:00.000Z",\n",
       "    "modified": "2020-06-26T19:29:38.943037Z",\n",
       "    "name": "File hash for suspicious file",\n",
       "    "indicator_types": [\n",
       "        "anomalous-activity"\n",
       "    ],\n",
       "    "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",\n",
       "    "pattern_type": "stix",\n",
       "    "pattern_version": "2.1",\n",
       "    "valid_from": "2020-06-26T19:27:20.759788Z",\n",
       "    "revoked": true\n",
       "}\n",
       "
\n" ], "text/plain": [ "" ] }, "execution_count": 7, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator4 = indicator3.revoke()\n", "print(indicator4)" ] } ], "metadata": { "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.9.0a6" } }, "nbformat": 4, "nbformat_minor": 2 }