52 lines
1.4 KiB
Python
52 lines
1.4 KiB
Python
"""Python APIs for STIX 2."""
|
|
|
|
# flake8: noqa
|
|
|
|
from .bundle import Bundle
|
|
from .other import ExternalReference, KillChainPhase, MarkingDefinition, \
|
|
GranularMarking, StatementMarking, TLPMarking
|
|
from .sdo import AttackPattern, Campaign, CourseOfAction, Identity, Indicator, \
|
|
IntrusionSet, Malware, ObservedData, Report, ThreatActor, Tool, \
|
|
Vulnerability
|
|
from .sro import Relationship, Sighting
|
|
from .utils import get_dict
|
|
from . import exceptions
|
|
|
|
|
|
OBJ_MAP = {
|
|
'attack-pattern': AttackPattern,
|
|
'campaign': Campaign,
|
|
'course-of-action': CourseOfAction,
|
|
'identity': Identity,
|
|
'indicator': Indicator,
|
|
'intrusion-set': IntrusionSet,
|
|
'malware': Malware,
|
|
'marking-definition': MarkingDefinition,
|
|
'observed-data': ObservedData,
|
|
'report': Report,
|
|
'relationship': Relationship,
|
|
'threat-actor': ThreatActor,
|
|
'tool': Tool,
|
|
'sighting': Sighting,
|
|
'vulnerability': Vulnerability,
|
|
}
|
|
|
|
|
|
def parse(data):
|
|
"""Deserialize a string or file-like object into a STIX object"""
|
|
|
|
obj = get_dict(data)
|
|
|
|
if 'type' not in obj:
|
|
# TODO parse external references, kill chain phases, and granular markings
|
|
pass
|
|
else:
|
|
try:
|
|
obj_class = OBJ_MAP[obj['type']]
|
|
return obj_class(**obj)
|
|
except KeyError:
|
|
# TODO handle custom objects
|
|
raise ValueError("Can't parse unknown object type!")
|
|
|
|
return obj
|