{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "collapsed": true,
    "nbsphinx": "hidden"
   },
   "outputs": [],
   "source": [
    "# Delete this cell to re-enable tracebacks\n",
    "import sys\n",
    "ipython = get_ipython()\n",
    "\n",
    "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
    "                   exception_only=False, running_compiled_code=False):\n",
    "    etype, value, tb = sys.exc_info()\n",
    "    return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
    "\n",
    "ipython.showtraceback = hide_traceback"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Creating STIX Content"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Creating STIX Domain Objects\n",
    "\n",
    "To create a STIX object, provide keyword arguments to the type's constructor:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "    \"type\": \"indicator\",\n",
      "    \"id\": \"indicator--38feb147-4277-45d7-b16c-5f60e24b88e1\",\n",
      "    \"created\": \"2017-09-14T18:17:15.709Z\",\n",
      "    \"modified\": \"2017-09-14T18:17:15.709Z\",\n",
      "    \"labels\": [\n",
      "        \"malicious-activity\"\n",
      "    ],\n",
      "    \"name\": \"File hash for malware variant\",\n",
      "    \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
      "    \"valid_from\": \"2017-09-14T18:17:15.709845Z\"\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "from stix2 import Indicator\n",
    "\n",
    "indicator = Indicator(name=\"File hash for malware variant\",\n",
    "                      labels=[\"malicious-activity\"],\n",
    "                      pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
    "print(indicator)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Certain required attributes of all objects will be set automatically if not provided as keyword arguments:\n",
    "\n",
    "-  If not provided, ``type`` will be set automatically to the correct type. You can also provide the type explicitly, but this is not necessary:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "indicator2 = Indicator(type='indicator',\n",
    "                       labels=[\"malicious-activity\"],\n",
    "                       pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Passing a value for ``type`` that does not match the class being constructed will cause an error:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "ename": "InvalidValueError",
     "evalue": "Invalid value for Indicator 'type': must equal 'indicator'.",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31mInvalidValueError\u001b[0m\u001b[0;31m:\u001b[0m Invalid value for Indicator 'type': must equal 'indicator'.\n"
     ]
    }
   ],
   "source": [
    "indicator3 = Indicator(type='xxx',\n",
    "                       labels=[\"malicious-activity\"],\n",
    "                       pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "-  If not provided, ``id`` will be generated randomly. If you provide an\n",
    "   ``id`` argument, it must begin with the correct prefix:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "ename": "InvalidValueError",
     "evalue": "Invalid value for Indicator 'id': must start with 'indicator--'.",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31mInvalidValueError\u001b[0m\u001b[0;31m:\u001b[0m Invalid value for Indicator 'id': must start with 'indicator--'.\n"
     ]
    }
   ],
   "source": [
    "indicator4 = Indicator(id=\"campaign--63ce9068-b5ab-47fa-a2cf-a602ea01f21a\",\n",
    "                       labels=[\"malicious-activity\"],\n",
    "                       pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "For indicators, ``labels`` and ``pattern`` are required and cannot be set automatically. Trying to create an indicator that is missing one of these properties will result in an error:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "ename": "MissingPropertiesError",
     "evalue": "No values for required properties for Indicator: (labels, pattern).",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31mMissingPropertiesError\u001b[0m\u001b[0;31m:\u001b[0m No values for required properties for Indicator: (labels, pattern).\n"
     ]
    }
   ],
   "source": [
    "indicator = Indicator()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "However, the required ``valid_from`` attribute on Indicators will be set to the current time if not provided as a keyword argument.\n",
    "\n",
    "Once created, the object acts like a frozen dictionary. Properties can be accessed using the standard Python dictionary syntax:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "u'File hash for malware variant'"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "indicator['name']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Or access properties using the standard Python attribute syntax:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "u'File hash for malware variant'"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "indicator.name"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Attempting to modify any attributes will raise an error:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "ename": "TypeError",
     "evalue": "'Indicator' object does not support item assignment",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31mTypeError\u001b[0m\u001b[0;31m:\u001b[0m 'Indicator' object does not support item assignment\n"
     ]
    }
   ],
   "source": [
    "indicator['name'] = \"This is a revised name\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "ename": "ImmutableError",
     "evalue": "Cannot modify 'name' property in 'Indicator' after creation.",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31mImmutableError\u001b[0m\u001b[0;31m:\u001b[0m Cannot modify 'name' property in 'Indicator' after creation.\n"
     ]
    }
   ],
   "source": [
    "indicator.name = \"This is a revised name\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "To update the properties of an object, see the **Versioning** section."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Creating a Malware object follows the same pattern:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "    \"type\": \"malware\",\n",
      "    \"id\": \"malware--b2eca08d-705a-4662-9b58-9ffe6a98cecd\",\n",
      "    \"created\": \"2017-09-14T18:38:09.395Z\",\n",
      "    \"modified\": \"2017-09-14T18:38:09.395Z\",\n",
      "    \"name\": \"Poison Ivy\",\n",
      "    \"labels\": [\n",
      "        \"remote-access-trojan\"\n",
      "    ]\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "from stix2 import Malware\n",
    "\n",
    "malware = Malware(name=\"Poison Ivy\",\n",
    "                  labels=['remote-access-trojan'])\n",
    "print(malware)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As with indicators, the ``type``, ``id``, ``created``, and ``modified`` properties will be set automatically if not provided. For Malware objects, the ``labels`` and ``name`` properties must be provided."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Creating Relationships\n",
    "\n",
    "STIX 2 Relationships are separate objects, not properties of the object on either side of the relationship. They are constructed similarly to other STIX objects. The ``type``, ``id``, ``created``, and ``modified`` properties are added automatically if not provided. Callers must provide the ``relationship_type``, ``source_ref``, and ``target_ref`` properties."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "    \"type\": \"relationship\",\n",
      "    \"id\": \"relationship--c42147ec-827a-492d-98d1-33eaaf4678e7\",\n",
      "    \"created\": \"2017-09-14T18:39:40.965Z\",\n",
      "    \"modified\": \"2017-09-14T18:39:40.965Z\",\n",
      "    \"relationship_type\": \"indicates\",\n",
      "    \"source_ref\": \"indicator--38feb147-4277-45d7-b16c-5f60e24b88e1\",\n",
      "    \"target_ref\": \"malware--b2eca08d-705a-4662-9b58-9ffe6a98cecd\"\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "from stix2 import Relationship\n",
    "\n",
    "relationship = Relationship(relationship_type='indicates',\n",
    "                            source_ref=indicator.id,\n",
    "                            target_ref=malware.id)\n",
    "print(relationship)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The ``source_ref`` and ``target_ref`` properties can be either the ID's of other STIX objects, or the STIX objects themselves. For readability, Relationship objects can also be constructed with the ``source_ref``, ``relationship_type``, and ``target_ref`` as positional (non-keyword) arguments:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "    \"type\": \"relationship\",\n",
      "    \"id\": \"relationship--0097e73a-6340-4394-a499-74e34dcd52fa\",\n",
      "    \"created\": \"2017-09-14T18:40:05.097Z\",\n",
      "    \"modified\": \"2017-09-14T18:40:05.097Z\",\n",
      "    \"relationship_type\": \"indicates\",\n",
      "    \"source_ref\": \"indicator--38feb147-4277-45d7-b16c-5f60e24b88e1\",\n",
      "    \"target_ref\": \"malware--b2eca08d-705a-4662-9b58-9ffe6a98cecd\"\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "relationship2 = Relationship(indicator, 'indicates', malware)\n",
    "print(relationship2)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Creating Bundles\n",
    "\n",
    "STIX Bundles can be created by passing objects as arguments to the Bundle constructor. All required properties (``type``, ``id``, and ``spec_version``) will be set automatically if not provided, or can be provided as keyword arguments:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "    \"type\": \"bundle\",\n",
      "    \"id\": \"bundle--54d649a4-5ab4-4ab6-b4c4-b52c09fbee9c\",\n",
      "    \"spec_version\": \"2.0\",\n",
      "    \"objects\": [\n",
      "        {\n",
      "            \"type\": \"indicator\",\n",
      "            \"id\": \"indicator--38feb147-4277-45d7-b16c-5f60e24b88e1\",\n",
      "            \"created\": \"2017-09-14T18:17:15.709Z\",\n",
      "            \"modified\": \"2017-09-14T18:17:15.709Z\",\n",
      "            \"labels\": [\n",
      "                \"malicious-activity\"\n",
      "            ],\n",
      "            \"name\": \"File hash for malware variant\",\n",
      "            \"pattern\": \"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
      "            \"valid_from\": \"2017-09-14T18:17:15.709845Z\"\n",
      "        },\n",
      "        {\n",
      "            \"type\": \"malware\",\n",
      "            \"id\": \"malware--b2eca08d-705a-4662-9b58-9ffe6a98cecd\",\n",
      "            \"created\": \"2017-09-14T18:38:09.395Z\",\n",
      "            \"modified\": \"2017-09-14T18:38:09.395Z\",\n",
      "            \"name\": \"Poison Ivy\",\n",
      "            \"labels\": [\n",
      "                \"remote-access-trojan\"\n",
      "            ]\n",
      "        },\n",
      "        {\n",
      "            \"type\": \"relationship\",\n",
      "            \"id\": \"relationship--c42147ec-827a-492d-98d1-33eaaf4678e7\",\n",
      "            \"created\": \"2017-09-14T18:39:40.965Z\",\n",
      "            \"modified\": \"2017-09-14T18:39:40.965Z\",\n",
      "            \"relationship_type\": \"indicates\",\n",
      "            \"source_ref\": \"indicator--38feb147-4277-45d7-b16c-5f60e24b88e1\",\n",
      "            \"target_ref\": \"malware--b2eca08d-705a-4662-9b58-9ffe6a98cecd\"\n",
      "        }\n",
      "    ]\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "from stix2 import Bundle\n",
    "\n",
    "bundle = Bundle(indicator, malware, relationship)\n",
    "print(bundle)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}