740 lines
45 KiB
Plaintext
740 lines
45 KiB
Plaintext
{
|
|
"cells": [
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 1,
|
|
"metadata": {
|
|
"nbsphinx": "hidden"
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"# Delete this cell to re-enable tracebacks\n",
|
|
"import sys\n",
|
|
"ipython = get_ipython()\n",
|
|
"\n",
|
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
|
" exception_only=False, running_compiled_code=False):\n",
|
|
" etype, value, tb = sys.exc_info()\n",
|
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
|
"\n",
|
|
"ipython.showtraceback = hide_traceback"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 2,
|
|
"metadata": {
|
|
"nbsphinx": "hidden"
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"# JSON output syntax highlighting\n",
|
|
"from __future__ import print_function\n",
|
|
"from pygments import highlight\n",
|
|
"from pygments.lexers import JsonLexer, TextLexer\n",
|
|
"from pygments.formatters import HtmlFormatter\n",
|
|
"from IPython.display import display, HTML\n",
|
|
"from IPython.core.interactiveshell import InteractiveShell\n",
|
|
"\n",
|
|
"InteractiveShell.ast_node_interactivity = \"all\"\n",
|
|
"\n",
|
|
"def json_print(inpt):\n",
|
|
" string = str(inpt)\n",
|
|
" formatter = HtmlFormatter()\n",
|
|
" if string[0] == '{':\n",
|
|
" lexer = JsonLexer()\n",
|
|
" else:\n",
|
|
" lexer = TextLexer()\n",
|
|
" return HTML('<style type=\"text/css\">{}</style>{}'.format(\n",
|
|
" formatter.get_style_defs('.highlight'),\n",
|
|
" highlight(string, lexer, formatter)))\n",
|
|
"\n",
|
|
"globals()['print'] = json_print"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Parsing STIX Content"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well.\n",
|
|
"\n",
|
|
"**Parsing a string**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 3,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.ObservedData'>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 3,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"first_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"last_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"number_observed"</span><span class=\"p\">:</span> <span class=\"mi\">50</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 3,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"from stix2 import parse\n",
|
|
"\n",
|
|
"input_string = \"\"\"{\n",
|
|
" \"type\": \"observed-data\",\n",
|
|
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
|
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
|
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
|
" \"first_observed\": \"2015-12-21T19:00:00Z\",\n",
|
|
" \"last_observed\": \"2015-12-21T19:00:00Z\",\n",
|
|
" \"number_observed\": 50,\n",
|
|
" \"objects\": {\n",
|
|
" \"0\": {\n",
|
|
" \"type\": \"file\",\n",
|
|
" \"hashes\": {\n",
|
|
" \"SHA-256\": \"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038\"\n",
|
|
" }\n",
|
|
" }\n",
|
|
" }\n",
|
|
"}\"\"\"\n",
|
|
"\n",
|
|
"obj = parse(input_string)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"**Parsing a dictionary**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 4,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.Identity'>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 4,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Cole Powers"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 4,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"input_dict = {\n",
|
|
" \"type\": \"identity\",\n",
|
|
" \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n",
|
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
|
" \"name\": \"Cole Powers\",\n",
|
|
" \"identity_class\": \"individual\"\n",
|
|
"}\n",
|
|
"\n",
|
|
"obj = parse(input_dict)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"**Parsing a file-like object**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 5,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><class 'stix2.v20.sdo.CourseOfAction'>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 5,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Data from Network Shared Drive Mitigation"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting[[CiteRef::Beechey 2010]] tools, like AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet Applocker vs SRP]]"</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 5,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"file_handle = open(\"/tmp/stix2_store/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd.json\")\n",
|
|
"\n",
|
|
"obj = parse(file_handle)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"### Parsing Custom STIX Content"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.core.rst#stix2.core.parse). Just supply the keyword argument ``allow_custom=True``. When ``allow_custom`` is specified, [parse()](../api/stix2.core.rst#stix2.core.parse) will attempt to convert the supplied STIX content to known STIX 2 domain objects and/or previously defined [custom STIX 2 objects](custom.ipynb). If the conversion cannot be completed (and ``allow_custom`` is specified), [parse()](../api/stix2.core.rst#stix2.core.parse) will treat the supplied STIX 2 content as valid STIX 2 objects and return them. **Warning: Specifying allow_custom may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom content occurs where the custom content supplied is not valid STIX 2**. This is an axiomatic possibility as the ``stix2`` library cannot guarantee proper processing of unknown custom STIX 2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n",
|
|
"\n",
|
|
"For examples of parsing STIX 2 objects with custom STIX properties, see [Custom STIX Content: Custom Properties](custom.ipynb#Custom-Properties)\n",
|
|
"\n",
|
|
"For examples of parsing defined custom STIX 2 objects, see [Custom STIX Content: Custom STIX Object Types](custom.ipynb#Custom-STIX-Object-Types)\n",
|
|
"\n",
|
|
"For retrieving STIX 2 content from a source (e.g. file system, TAXII) that may possibly have custom STIX 2 content unknown to the user, the user can create a STIX 2 DataStore/Source with the flag ``allow_custom=True``. As mentioned, this will configure the DataStore/Source to allow for unknown STIX 2 content to be returned (albeit not converted to full STIX 2 domain objects and properties); the ``stix2`` library may preclude processing the unknown content, if the content is not valid or actual STIX 2 domain objects and properties."
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {
|
|
"collapsed": true
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"from taxii2client import Collection\n",
|
|
"from stix2 import CompositeDataSource, FileSystemSource, TAXIICollectionSource\n",
|
|
"\n",
|
|
"# to allow for the retrieval of unknown custom STIX2 content,\n",
|
|
"# just create *Stores/*Sources with the 'allow_custom' flag\n",
|
|
"\n",
|
|
"# create FileSystemStore\n",
|
|
"fs = FileSystemSource(\"/path/to/stix2_data/\", allow_custom=True)\n",
|
|
"\n",
|
|
"# create TAXIICollectionSource\n",
|
|
"colxn = Collection('http://taxii_url')\n",
|
|
"ts = TAXIICollectionSource(colxn, allow_custom=True)"
|
|
]
|
|
}
|
|
],
|
|
"metadata": {
|
|
"kernelspec": {
|
|
"display_name": "Python 3",
|
|
"language": "python",
|
|
"name": "python3"
|
|
},
|
|
"language_info": {
|
|
"codemirror_mode": {
|
|
"name": "ipython",
|
|
"version": 3
|
|
},
|
|
"file_extension": ".py",
|
|
"mimetype": "text/x-python",
|
|
"name": "python",
|
|
"nbconvert_exporter": "python",
|
|
"pygments_lexer": "ipython3",
|
|
"version": "3.6.3"
|
|
}
|
|
},
|
|
"nbformat": 4,
|
|
"nbformat_minor": 2
|
|
}
|