{ "cells": [ { "cell_type": "code", "execution_count": 6, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# Delete this cell to re-enable tracebacks\n", "import sys\n", "ipython = get_ipython()\n", "\n", "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n", " exception_only=False, running_compiled_code=False):\n", " etype, value, tb = sys.exc_info()\n", " return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n", "\n", "ipython.showtraceback = hide_traceback" ] }, { "cell_type": "code", "execution_count": 5, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# JSON output syntax highlighting\n", "from __future__ import print_function\n", "from pygments import highlight\n", "from pygments.lexers import JsonLexer, TextLexer\n", "from pygments.formatters import HtmlFormatter\n", "from IPython.display import display, HTML\n", "from IPython.core.interactiveshell import InteractiveShell\n", "\n", "InteractiveShell.ast_node_interactivity = \"all\"\n", "\n", "def json_print(inpt):\n", " string = str(inpt)\n", " formatter = HtmlFormatter()\n", " if string[0] == '{':\n", " lexer = JsonLexer()\n", " else:\n", " lexer = TextLexer()\n", " return HTML('<style type=\"text/css\">{}</style>{}'.format(\n", " formatter.get_style_defs('.highlight'),\n", " highlight(string, lexer, formatter)))\n", "\n", "globals()['print'] = json_print" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## Data Markings" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Creating Objects With Data Markings\n", "\n", "To create an object with a (predefined) TLP marking to an object, just provide it as a keyword argument to the constructor. The TLP markings can easily be imported from python-stix2." ] }, { "cell_type": "code", "execution_count": 7, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924708Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 7, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Indicator, TLP_AMBER\n", "\n", "indicator = Indicator(labels=[\"malicious-activity\"],\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=TLP_AMBER)\n", "print(indicator)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "If you’re creating your own marking (for example, a ``Statement`` marking), first create the statement marking:" ] }, { "cell_type": "code", "execution_count": 8, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:53.98008Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"definition_type"</span><span class=\"p\">:</span> <span class=\"s2\">"statement"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"definition"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n", " <span class=\"nt\">"statement"</span><span class=\"p\">:</span> <span class=\"s2\">"Copyright 2017, Example Corp"</span>\n", " <span class=\"p\">}</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 8, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import MarkingDefinition, StatementMarking\n", "\n", "marking_definition = MarkingDefinition( \n", " definition_type=\"statement\", \n", " definition=StatementMarking(statement=\"Copyright 2017, Example Corp\")\n", ")\n", "print(marking_definition)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Then you can add it to an object as it’s being created (passing either full object or the the ID as a keyword argument, like with relationships)." ] }, { "cell_type": "code", "execution_count": 9, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--7caeab49-2472-41bb-a988-2f990aea99bd"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:55.763Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:55.763Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:55.763364Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 9, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator2 = Indicator(labels=[\"malicious-activity\"],\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=marking_definition)\n", "print(indicator2)" ] }, { "cell_type": "code", "execution_count": 10, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--4eb21bbe-b8a9-4348-86cf-1ed52f9abdd7"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:57.248Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:57.248Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:57.248658Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 10, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator3 = Indicator(labels=[\"malicious-activity\"],\n", " pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n", " object_marking_refs=\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\")\n", "print(indicator3)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Granular markings work in the same way, except you also need to provide a full granular-marking object (including the selector)." ] }, { "cell_type": "code", "execution_count": 11, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--ef1eddbb-b5a5-47e0-b607-75b9870d8d91"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:59.103Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:59.103Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"A ransomware related to ..."</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"remote-access-trojan"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"granular_markings"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"p\">{</span>\n", " <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"description"</span>\n", " <span class=\"p\">]</span>\n", " <span class=\"p\">},</span>\n", " <span class=\"p\">{</span>\n", " <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"name"</span>\n", " <span class=\"p\">]</span>\n", " <span class=\"p\">}</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 11, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import Malware, TLP_WHITE\n", "\n", "malware = Malware(name=\"Poison Ivy\",\n", " labels=['remote-access-trojan'],\n", " description=\"A ransomware related to ...\",\n", " granular_markings=[\n", " {\n", " \"selectors\": [\"description\"],\n", " \"marking_ref\": marking_definition\n", " },\n", " {\n", " \"selectors\": [\"name\"],\n", " \"marking_ref\": TLP_WHITE\n", " }\n", " ])\n", "print(malware)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Make sure that the selector is a field that exists and is populated on the object, otherwise this will cause an error:" ] }, { "cell_type": "code", "execution_count": 12, "metadata": {}, "outputs": [ { "ename": "InvalidSelectorError", "evalue": "Selector title in Malware is not valid!", "output_type": "error", "traceback": [ "\u001b[0;31mInvalidSelectorError\u001b[0m\u001b[0;31m:\u001b[0m Selector title in Malware is not valid!\n" ] } ], "source": [ "Malware(name=\"Poison Ivy\",\n", " labels=['remote-access-trojan'],\n", " description=\"A ransomware related to ...\",\n", " granular_markings=[\n", " {\n", " \"selectors\": [\"title\"],\n", " \"marking_ref\": marking_definition\n", " }\n", " ])" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Adding Data Markings To Existing Objects" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "[Several functions](../api/stix2.markings.rst) exist to support working with data markings.\n", "\n", "Both object markings and granular markings can be added to STIX objects which have already been created.\n", "\n", "**Note**: Doing so will create a new version of the object (note the updated ``modified`` time)." ] }, { "cell_type": "code", "execution_count": 13, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:03.387Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924708Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368"</span><span class=\"p\">,</span>\n", " <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 13, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator4 = indicator.add_markings(marking_definition)\n", "print(indicator4)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "You can also remove specific markings from STIX objects. This will also create a new version of the object." ] }, { "cell_type": "code", "execution_count": 14, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:05.109Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924708Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 14, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator5 = indicator4.remove_markings(marking_definition)\n", "print(indicator5)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "The markings on an object can be replaced with a different set of markings:" ] }, { "cell_type": "code", "execution_count": 15, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:06.773Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924708Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">],</span>\n", " <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368"</span><span class=\"p\">,</span>\n", " <span class=\"s2\">"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 15, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import TLP_GREEN\n", "\n", "indicator6 = indicator5.set_markings([TLP_GREEN, marking_definition])\n", "print(indicator6)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "STIX objects can also be cleared of all markings with [clear_markings()](../api/stix2.markings.rst#stix2.markings.clear_markings):" ] }, { "cell_type": "code", "execution_count": 16, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--95a71cff-fad0-4ffb-a641-8a6eaa642290"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:50:08.616Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2018-04-05T19:49:47.924708Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"labels"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n", " <span class=\"s2\">"malicious-activity"</span>\n", " <span class=\"p\">]</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 16, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator7 = indicator5.clear_markings()\n", "print(indicator7)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "All of these functions can be used for granular markings by passing in a list of selectors. Note that they will create new versions of the objects." ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Evaluating Data Markings\n", "\n", "You can get a list of the object markings on a STIX object:" ] }, { "cell_type": "code", "execution_count": 17, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--13680b12-3d19-4b42-abe6-0d31effe5368',\n", " 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']" ] }, "execution_count": 17, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator6.get_markings()" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "To get a list of the granular markings on an object, pass the object and a list of selectors to [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings):" ] }, { "cell_type": "code", "execution_count": 18, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']" ] }, "execution_count": 18, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import get_markings\n", "\n", "get_markings(malware, 'name')" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "You can also call [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings) as a method on the STIX object." ] }, { "cell_type": "code", "execution_count": 19, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.get_markings('name')" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Finally, you may also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors." ] }, { "cell_type": "code", "execution_count": 20, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "True" ] }, "execution_count": 20, "metadata": {}, "output_type": "execute_result" } ], "source": [ "indicator.is_marked(TLP_AMBER.id)" ] }, { "cell_type": "code", "execution_count": 21, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "True" ] }, "execution_count": 21, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.is_marked(TLP_WHITE.id, 'name')" ] }, { "cell_type": "code", "execution_count": 22, "metadata": { "scrolled": true }, "outputs": [ { "data": { "text/plain": [ "False" ] }, "execution_count": 22, "metadata": {}, "output_type": "execute_result" } ], "source": [ "malware.is_marked(TLP_WHITE.id, 'description')" ] } ], "metadata": { "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.6.3" } }, "nbformat": 4, "nbformat_minor": 2 }