{ "cells": [ { "cell_type": "code", "execution_count": 1, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# Delete this cell to re-enable tracebacks\n", "import sys\n", "ipython = get_ipython()\n", "\n", "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n", " exception_only=False, running_compiled_code=False):\n", " etype, value, tb = sys.exc_info()\n", " return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n", "\n", "ipython.showtraceback = hide_traceback" ] }, { "cell_type": "code", "execution_count": 2, "metadata": { "nbsphinx": "hidden" }, "outputs": [], "source": [ "# JSON output syntax highlighting\n", "from __future__ import print_function\n", "from pygments import highlight\n", "from pygments.lexers import JsonLexer, TextLexer\n", "from pygments.formatters import HtmlFormatter\n", "from IPython.display import display, HTML\n", "from IPython.core.interactiveshell import InteractiveShell\n", "\n", "InteractiveShell.ast_node_interactivity = \"all\"\n", "\n", "def json_print(inpt):\n", " string = str(inpt)\n", " formatter = HtmlFormatter()\n", " if string[0] == '{':\n", " lexer = JsonLexer()\n", " else:\n", " lexer = TextLexer()\n", " return HTML('<style type=\"text/css\">{}</style>{}'.format(\n", " formatter.get_style_defs('.highlight'),\n", " highlight(string, lexer, formatter)))\n", "\n", "globals()['print'] = json_print" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## Parsing STIX Content" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well.\n", "\n", "**Parsing a string**" ] }, { "cell_type": "code", "execution_count": 3, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.ObservedData'>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 3, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"first_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"last_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"number_observed"</span><span class=\"p\">:</span> <span class=\"mi\">50</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n", " <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n", " <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n", " <span class=\"p\">}</span>\n", " <span class=\"p\">}</span>\n", " <span class=\"p\">}</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 3, "metadata": {}, "output_type": "execute_result" } ], "source": [ "from stix2 import parse\n", "\n", "input_string = \"\"\"{\n", " \"type\": \"observed-data\",\n", " \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n", " \"created\": \"2016-04-06T19:58:16.000Z\",\n", " \"modified\": \"2016-04-06T19:58:16.000Z\",\n", " \"first_observed\": \"2015-12-21T19:00:00Z\",\n", " \"last_observed\": \"2015-12-21T19:00:00Z\",\n", " \"number_observed\": 50,\n", " \"objects\": {\n", " \"0\": {\n", " \"type\": \"file\",\n", " \"hashes\": {\n", " \"SHA-256\": \"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038\"\n", " }\n", " }\n", " }\n", "}\"\"\"\n", "\n", "obj = parse(input_string)\n", "print(type(obj))\n", "print(obj)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "**Parsing a dictionary**" ] }, { "cell_type": "code", "execution_count": 4, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.Identity'>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Cole Powers"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "source": [ "input_dict = {\n", " \"type\": \"identity\",\n", " \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n", " \"created\": \"2015-12-21T19:59:11Z\",\n", " \"modified\": \"2015-12-21T19:59:11Z\",\n", " \"name\": \"Cole Powers\",\n", " \"identity_class\": \"individual\"\n", "}\n", "\n", "obj = parse(input_dict)\n", "print(type(obj))\n", "print(obj)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "**Parsing a file-like object**" ] }, { "cell_type": "code", "execution_count": 5, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.CourseOfAction'>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 5, "metadata": {}, "output_type": "execute_result" }, { "data": { "text/html": [ "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", ".highlight { background: #f8f8f8; }\n", ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", ".highlight .o { color: #666666 } /* Operator */\n", ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", ".highlight .ge { font-style: italic } /* Generic.Emph */\n", ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", ".highlight .go { color: #888888 } /* Generic.Output */\n", ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", ".highlight .m { color: #666666 } /* Literal.Number */\n", ".highlight .s { color: #BA2121 } /* Literal.String */\n", ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", ".highlight .nb { color: #008000 } /* Name.Builtin */\n", ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", ".highlight .no { color: #880000 } /* Name.Constant */\n", ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", ".highlight .nf { color: #0000FF } /* Name.Function */\n", ".highlight .nl { color: #A0A000 } /* Name.Label */\n", ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", ".highlight .nv { color: #19177C } /* Name.Variable */\n", ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Data from Network Shared Drive Mitigation"</span><span class=\"p\">,</span>\n", " <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting[[CiteRef::Beechey 2010]] tools, like AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet Applocker vs SRP]]"</span>\n", "<span class=\"p\">}</span>\n", "</pre></div>\n" ], "text/plain": [ "<IPython.core.display.HTML object>" ] }, "execution_count": 5, "metadata": {}, "output_type": "execute_result" } ], "source": [ "file_handle = open(\"/tmp/stix2_store/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd.json\")\n", "\n", "obj = parse(file_handle)\n", "print(type(obj))\n", "print(obj)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "### Parsing Custom STIX Content" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.core.rst#stix2.core.parse). Just supply the keyword argument ``allow_custom=True``. When ``allow_custom`` is specified, [parse()](../api/stix2.core.rst#stix2.core.parse) will attempt to convert the supplied STIX content to known STIX 2 domain objects and/or previously defined [custom STIX 2 objects](custom.ipynb). If the conversion cannot be completed (and ``allow_custom`` is specified), [parse()](../api/stix2.core.rst#stix2.core.parse) will treat the supplied STIX 2 content as valid STIX 2 objects and return them. **Warning: Specifying allow_custom may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom content occurs where the custom content supplied is not valid STIX 2**. This is an axiomatic possibility as the ``stix2`` library cannot guarantee proper processing of unknown custom STIX 2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n", "\n", "For examples of parsing STIX 2 objects with custom STIX properties, see [Custom STIX Content: Custom Properties](custom.ipynb#Custom-Properties)\n", "\n", "For examples of parsing defined custom STIX 2 objects, see [Custom STIX Content: Custom STIX Object Types](custom.ipynb#Custom-STIX-Object-Types)\n", "\n", "For retrieving STIX 2 content from a source (e.g. file system, TAXII) that may possibly have custom STIX 2 content unknown to the user, the user can create a STIX 2 DataStore/Source with the flag ``allow_custom=True``. As mentioned, this will configure the DataStore/Source to allow for unknown STIX 2 content to be returned (albeit not converted to full STIX 2 domain objects and properties); the ``stix2`` library may preclude processing the unknown content, if the content is not valid or actual STIX 2 domain objects and properties." ] }, { "cell_type": "code", "execution_count": null, "metadata": { "collapsed": true }, "outputs": [], "source": [ "from taxii2client import Collection\n", "from stix2 import CompositeDataSource, FileSystemSource, TAXIICollectionSource\n", "\n", "# to allow for the retrieval of unknown custom STIX2 content,\n", "# just create *Stores/*Sources with the 'allow_custom' flag\n", "\n", "# create FileSystemStore\n", "fs = FileSystemSource(\"/path/to/stix2_data/\", allow_custom=True)\n", "\n", "# create TAXIICollectionSource\n", "colxn = Collection('http://taxii_url')\n", "ts = TAXIICollectionSource(colxn, allow_custom=True)" ] } ], "metadata": { "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.6.3" } }, "nbformat": 4, "nbformat_minor": 2 }