2177 lines
138 KiB
Plaintext
2177 lines
138 KiB
Plaintext
{
|
||
"cells": [
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 1,
|
||
"metadata": {
|
||
"nbsphinx": "hidden"
|
||
},
|
||
"outputs": [],
|
||
"source": [
|
||
"# Delete this cell to re-enable tracebacks\n",
|
||
"import sys\n",
|
||
"ipython = get_ipython()\n",
|
||
"\n",
|
||
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
||
" exception_only=False, running_compiled_code=False):\n",
|
||
" etype, value, tb = sys.exc_info()\n",
|
||
" value.__cause__ = None # suppress chained exceptions\n",
|
||
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
||
"\n",
|
||
"ipython.showtraceback = hide_traceback"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 2,
|
||
"metadata": {
|
||
"nbsphinx": "hidden"
|
||
},
|
||
"outputs": [],
|
||
"source": [
|
||
"# JSON output syntax highlighting\n",
|
||
"from __future__ import print_function\n",
|
||
"from pygments import highlight\n",
|
||
"from pygments.lexers import JsonLexer, TextLexer\n",
|
||
"from pygments.formatters import HtmlFormatter\n",
|
||
"from IPython.display import display, HTML\n",
|
||
"from IPython.core.interactiveshell import InteractiveShell\n",
|
||
"\n",
|
||
"InteractiveShell.ast_node_interactivity = \"all\"\n",
|
||
"\n",
|
||
"def json_print(inpt):\n",
|
||
" string = str(inpt)\n",
|
||
" formatter = HtmlFormatter()\n",
|
||
" if string[0] == '{':\n",
|
||
" lexer = JsonLexer()\n",
|
||
" else:\n",
|
||
" lexer = TextLexer()\n",
|
||
" return HTML('<style type=\"text/css\">{}</style>{}'.format(\n",
|
||
" formatter.get_style_defs('.highlight'),\n",
|
||
" highlight(string, lexer, formatter)))\n",
|
||
"\n",
|
||
"globals()['print'] = json_print"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"## Data Markings"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Creating Objects With Data Markings\n",
|
||
"\n",
|
||
"To create an object with a (predefined) TLP marking to an object, just provide it as a keyword argument to the constructor. The TLP markings can easily be imported from python-stix2."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 3,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 3,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import Indicator, TLP_AMBER\n",
|
||
"\n",
|
||
"indicator = Indicator(pattern_type=\"stix\",\n",
|
||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
|
||
" object_marking_refs=TLP_AMBER)\n",
|
||
"print(indicator.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"If you’re creating your own marking (for example, a ``Statement`` marking), first create the statement marking:"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 4,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:50.587649Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"definition_type"</span><span class=\"p\">:</span> <span class=\"s2\">"statement"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"definition"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"statement"</span><span class=\"p\">:</span> <span class=\"s2\">"Copyright 2017, Example Corp"</span>\n",
|
||
" <span class=\"p\">}</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 4,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import MarkingDefinition, StatementMarking\n",
|
||
"\n",
|
||
"marking_definition = MarkingDefinition( \n",
|
||
" definition_type=\"statement\", \n",
|
||
" definition=StatementMarking(statement=\"Copyright 2017, Example Corp\")\n",
|
||
")\n",
|
||
"print(marking_definition.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"Then you can add it to an object as it’s being created (passing either full object or the the ID as a keyword argument, like with relationships)."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 5,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--91ed23a6-c5f0-4b16-8369-64cf39f974bf"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:52.602254Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:52.602254Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:52.602254Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 5,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator2 = Indicator(pattern_type=\"stix\",\n",
|
||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
|
||
" object_marking_refs=marking_definition)\n",
|
||
"print(indicator2.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 6,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--42ae262e-4839-4c1a-a50a-3a6690623a9d"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:54.207797Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:54.207797Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:54.207797Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 6,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator3 = Indicator(pattern_type=\"stix\",\n",
|
||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
|
||
" object_marking_refs=\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\")\n",
|
||
"print(indicator3.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"Granular markings work in the same way, except you also need to provide a full granular-marking object (including the selector)."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 7,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"malware"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"malware--2658ac6a-44e9-44ea-8c8a-d67abae4d0d5"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:56.556801Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:56.556801Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Poison Ivy"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"A ransomware related to ..."</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"is_family"</span><span class=\"p\">:</span> <span class=\"kc\">false</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"granular_markings"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"description"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">},</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"name"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">}</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 7,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import Malware, TLP_WHITE\n",
|
||
"\n",
|
||
"malware = Malware(name=\"Poison Ivy\",\n",
|
||
" description=\"A ransomware related to ...\",\n",
|
||
" is_family=False,\n",
|
||
" granular_markings=[\n",
|
||
" {\n",
|
||
" \"selectors\": [\"description\"],\n",
|
||
" \"marking_ref\": marking_definition\n",
|
||
" },\n",
|
||
" {\n",
|
||
" \"selectors\": [\"name\"],\n",
|
||
" \"marking_ref\": TLP_WHITE\n",
|
||
" }\n",
|
||
" ])\n",
|
||
"print(malware.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"Make sure that the selector is a field that exists and is populated on the object, otherwise this will cause an error:"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 8,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"ename": "InvalidSelectorError",
|
||
"evalue": "Selector title in Malware is not valid!",
|
||
"output_type": "error",
|
||
"traceback": [
|
||
"\u001b[0;31mInvalidSelectorError\u001b[0m\u001b[0;31m:\u001b[0m Selector title in Malware is not valid!\n"
|
||
]
|
||
}
|
||
],
|
||
"source": [
|
||
"Malware(name=\"Poison Ivy\",\n",
|
||
" description=\"A ransomware related to ...\",\n",
|
||
" is_family=False,\n",
|
||
" granular_markings=[\n",
|
||
" {\n",
|
||
" \"selectors\": [\"title\"],\n",
|
||
" \"marking_ref\": marking_definition\n",
|
||
" }\n",
|
||
" ])"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Adding Data Markings To Existing Objects"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"[Several functions](../api/stix2.markings.rst) exist to support working with data markings.\n",
|
||
"\n",
|
||
"Both object markings and granular markings can be added to STIX objects which have already been created.\n",
|
||
"\n",
|
||
"**Note**: Doing so will create a new version of the object (note the updated ``modified`` time)."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 9,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:00:01.165749Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 9,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator4 = indicator.add_markings(marking_definition)\n",
|
||
"print(indicator4.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"You can also remove specific markings from STIX objects. This will also create a new version of the object."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 10,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:00:03.00911Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 10,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator5 = indicator4.remove_markings(marking_definition)\n",
|
||
"print(indicator5.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"The markings on an object can be replaced with a different set of markings:"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 11,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:00:04.531083Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"s2\">"marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 11,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import TLP_GREEN\n",
|
||
"\n",
|
||
"indicator6 = indicator5.set_markings([TLP_GREEN, marking_definition])\n",
|
||
"print(indicator6.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"STIX objects can also be cleared of all markings with [clear_markings()](../api/stix2.markings.rst#stix2.markings.clear_markings):"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 12,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a315ce0b-1211-478e-812a-cd6d3eecc3c1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:00:06.512465Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T13:59:48.911595Z"</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 12,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator7 = indicator5.clear_markings()\n",
|
||
"print(indicator7.serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"All of these functions can be used for granular markings by passing in a list of selectors. Note that they will create new versions of the objects."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"### Evaluating Data Markings\n",
|
||
"\n",
|
||
"You can get a list of the object markings on a STIX object:"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 13,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da',\n",
|
||
" 'marking-definition--4b8e86b5-d505-46a4-91b4-a8db17f4ff4d']"
|
||
]
|
||
},
|
||
"execution_count": 13,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator6.get_markings()"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"To get a list of the granular markings on an object, pass the object and a list of selectors to [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings):"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 14,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']"
|
||
]
|
||
},
|
||
"execution_count": 14,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import get_markings\n",
|
||
"\n",
|
||
"get_markings(malware, 'name')"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"You can also call [get_markings()](../api/stix2.markings.rst#stix2.markings.get_markings) as a method on the STIX object."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 15,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']"
|
||
]
|
||
},
|
||
"execution_count": 15,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"malware.get_markings('name')"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"Finally, you may also check if an object is marked by a specific markings. Again, for granular markings, pass in the selector or list of selectors."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 16,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"True"
|
||
]
|
||
},
|
||
"execution_count": 16,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"indicator.is_marked(TLP_AMBER.id)"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 17,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"True"
|
||
]
|
||
},
|
||
"execution_count": 17,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"malware.is_marked(TLP_WHITE.id, 'name')"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 18,
|
||
"metadata": {
|
||
"scrolled": true
|
||
},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/plain": [
|
||
"False"
|
||
]
|
||
},
|
||
"execution_count": 18,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"malware.is_marked(TLP_WHITE.id, 'description')"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"# Extracting Lang Data Markings or marking-definition Data Markings\n",
|
||
"\n",
|
||
"If you need a specific kind of marking, you can also filter them using the API. By default the library will get both types of markings by default. You can choose between `lang=True/False` or `marking_ref=True/False` depending on your use-case."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Una descripcion sobre este indicador"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"malware"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"granular_markings"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"lang"</span><span class=\"p\">:</span> <span class=\"s2\">"es"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"description"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">},</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"description"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">}</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da', 'es']\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da']\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
},
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>['es']\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 19,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"from stix2 import Indicator\n",
|
||
"\n",
|
||
"v21_indicator = Indicator(\n",
|
||
" description=\"Una descripcion sobre este indicador\",\n",
|
||
" pattern_type=\"stix\",\n",
|
||
" pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\",\n",
|
||
" object_marking_refs=['marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'],\n",
|
||
" indicator_types=['malware'],\n",
|
||
" granular_markings=[\n",
|
||
" {\n",
|
||
" 'selectors': ['description'],\n",
|
||
" 'lang': 'es'\n",
|
||
" },\n",
|
||
" {\n",
|
||
" 'selectors': ['description'],\n",
|
||
" 'marking_ref': 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da'\n",
|
||
" }\n",
|
||
" ]\n",
|
||
")\n",
|
||
"print(v21_indicator.serialize(pretty=True))\n",
|
||
"\n",
|
||
"# Gets both lang and marking_ref markings for 'description'\n",
|
||
"print(v21_indicator.get_markings('description'))\n",
|
||
"\n",
|
||
"# Exclude lang markings from results\n",
|
||
"print(v21_indicator.get_markings('description', lang=False))\n",
|
||
"\n",
|
||
"# Exclude marking-definition markings from results\n",
|
||
"print(v21_indicator.get_markings('description', marking_ref=False))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "markdown",
|
||
"metadata": {},
|
||
"source": [
|
||
"In this same manner, calls to `clear_markings` and `set_markings` also have the ability to operate in for one or both types of markings."
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 21,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:03:11.817032Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Una descripcion sobre este indicador"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"malware"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 21,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"# By default, both types of markings will be removed\n",
|
||
"print(v21_indicator.clear_markings(\"description\").serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 22,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:03:24.701927Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Una descripcion sobre este indicador"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"malware"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"granular_markings"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"lang"</span><span class=\"p\">:</span> <span class=\"s2\">"es"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"description"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">}</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 22,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"# If lang is False, no lang markings will be removed\n",
|
||
"print(v21_indicator.clear_markings(\"description\", lang=False).serialize(pretty=True))"
|
||
]
|
||
},
|
||
{
|
||
"cell_type": "code",
|
||
"execution_count": 23,
|
||
"metadata": {},
|
||
"outputs": [
|
||
{
|
||
"data": {
|
||
"text/html": [
|
||
"<style type=\"text/css\">pre { line-height: 125%; }\n",
|
||
"td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }\n",
|
||
"td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
"span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }\n",
|
||
".highlight .hll { background-color: #ffffcc }\n",
|
||
".highlight { background: #f8f8f8; }\n",
|
||
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
||
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
||
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
||
".highlight .o { color: #666666 } /* Operator */\n",
|
||
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
||
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
||
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
||
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
||
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
||
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
||
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
||
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
||
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
||
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
||
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
||
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
||
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
||
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
||
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
||
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
||
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
||
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
||
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
||
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
||
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
||
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
||
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
||
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
||
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
||
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
||
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
||
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
||
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
||
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
||
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
||
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
||
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
||
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
||
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
||
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
||
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
||
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
||
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
||
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
||
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
||
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
||
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
||
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
||
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
||
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
||
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
||
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
||
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
||
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
||
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
||
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
||
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
||
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
||
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
||
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
||
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
||
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
||
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
||
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
||
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
||
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
||
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"indicator--a2fd263a-ec46-4fff-84af-27419f0b9f15"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:03:29.751985Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Una descripcion sobre este indicador"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"indicator_types"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"malware"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"pattern"</span><span class=\"p\">:</span> <span class=\"s2\">"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_type"</span><span class=\"p\">:</span> <span class=\"s2\">"stix"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"pattern_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"valid_from"</span><span class=\"p\">:</span> <span class=\"s2\">"2021-04-09T14:02:31.991141Z"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"object_marking_refs"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"</span>\n",
|
||
" <span class=\"p\">],</span>\n",
|
||
" <span class=\"nt\">"granular_markings"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"p\">{</span>\n",
|
||
" <span class=\"nt\">"marking_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"</span><span class=\"p\">,</span>\n",
|
||
" <span class=\"nt\">"selectors"</span><span class=\"p\">:</span> <span class=\"p\">[</span>\n",
|
||
" <span class=\"s2\">"description"</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
" <span class=\"p\">}</span>\n",
|
||
" <span class=\"p\">]</span>\n",
|
||
"<span class=\"p\">}</span>\n",
|
||
"</pre></div>\n"
|
||
],
|
||
"text/plain": [
|
||
"<IPython.core.display.HTML object>"
|
||
]
|
||
},
|
||
"execution_count": 23,
|
||
"metadata": {},
|
||
"output_type": "execute_result"
|
||
}
|
||
],
|
||
"source": [
|
||
"# If marking_ref is False, no marking-definition markings will be removed\n",
|
||
"print(v21_indicator.clear_markings(\"description\", marking_ref=False).serialize(pretty=True))"
|
||
]
|
||
}
|
||
],
|
||
"metadata": {
|
||
"kernelspec": {
|
||
"display_name": "Python 3",
|
||
"language": "python",
|
||
"name": "python3"
|
||
},
|
||
"language_info": {
|
||
"codemirror_mode": {
|
||
"name": "ipython",
|
||
"version": 3
|
||
},
|
||
"file_extension": ".py",
|
||
"mimetype": "text/x-python",
|
||
"name": "python",
|
||
"nbconvert_exporter": "python",
|
||
"pygments_lexer": "ipython3",
|
||
"version": "3.9.2"
|
||
}
|
||
},
|
||
"nbformat": 4,
|
||
"nbformat_minor": 2
|
||
}
|