515 lines
29 KiB
Plaintext
515 lines
29 KiB
Plaintext
{
|
|
"cells": [
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 1,
|
|
"metadata": {
|
|
"collapsed": true,
|
|
"nbsphinx": "hidden"
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"# Delete this cell to re-enable tracebacks\n",
|
|
"import sys\n",
|
|
"ipython = get_ipython()\n",
|
|
"\n",
|
|
"def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n",
|
|
" exception_only=False, running_compiled_code=False):\n",
|
|
" etype, value, tb = sys.exc_info()\n",
|
|
" return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n",
|
|
"\n",
|
|
"ipython.showtraceback = hide_traceback"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 2,
|
|
"metadata": {
|
|
"collapsed": true,
|
|
"nbsphinx": "hidden"
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"# JSON output syntax highlighting\n",
|
|
"from __future__ import print_function\n",
|
|
"from pygments import highlight\n",
|
|
"from pygments.lexers import JsonLexer\n",
|
|
"from pygments.formatters import HtmlFormatter\n",
|
|
"from IPython.display import HTML\n",
|
|
"\n",
|
|
"original_print = print\n",
|
|
"\n",
|
|
"def json_print(inpt):\n",
|
|
" string = str(inpt)\n",
|
|
" if string[0] == '{':\n",
|
|
" formatter = HtmlFormatter()\n",
|
|
" return HTML('<style type=\"text/css\">{}</style>{}'.format(\n",
|
|
" formatter.get_style_defs('.highlight'),\n",
|
|
" highlight(string, JsonLexer(), formatter)))\n",
|
|
" else:\n",
|
|
" original_print(inpt)\n",
|
|
"\n",
|
|
"print = json_print"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Parsing STIX Content"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"Parsing STIX content is as easy as calling the [parse()](../api/stix2.core.rst#stix2.core.parse) function on a JSON string, dictionary, or file-like object. It will automatically determine the type of the object. The STIX objects within `bundle` objects, and the cyber observables contained within `observed-data` objects will be parsed as well.\n",
|
|
"\n",
|
|
"**Parsing a string**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 10,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"name": "stdout",
|
|
"output_type": "stream",
|
|
"text": [
|
|
"<class 'stix2.v20.sdo.ObservedData'>\n"
|
|
]
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2016-04-06T19:58:16.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"first_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"last_observed"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:00:00Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"number_observed"</span><span class=\"p\">:</span> <span class=\"mi\">50</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"objects"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"0"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"file"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"hashes"</span><span class=\"p\">:</span> <span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"SHA-256"</span><span class=\"p\">:</span> <span class=\"s2\">"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038"</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
" <span class=\"p\">}</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 10,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"from stix2 import parse\n",
|
|
"\n",
|
|
"input_string = \"\"\"{\n",
|
|
" \"type\": \"observed-data\",\n",
|
|
" \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n",
|
|
" \"created\": \"2016-04-06T19:58:16.000Z\",\n",
|
|
" \"modified\": \"2016-04-06T19:58:16.000Z\",\n",
|
|
" \"first_observed\": \"2015-12-21T19:00:00Z\",\n",
|
|
" \"last_observed\": \"2015-12-21T19:00:00Z\",\n",
|
|
" \"number_observed\": 50,\n",
|
|
" \"objects\": {\n",
|
|
" \"0\": {\n",
|
|
" \"type\": \"file\",\n",
|
|
" \"hashes\": {\n",
|
|
" \"SHA-256\": \"0969de02ecf8a5f003e3f6d063d848c8a193aada092623f8ce408c15bcb5f038\"\n",
|
|
" }\n",
|
|
" }\n",
|
|
" }\n",
|
|
"}\"\"\"\n",
|
|
"\n",
|
|
"obj = parse(input_string)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"**Parsing a dictionary**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 7,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"name": "stdout",
|
|
"output_type": "stream",
|
|
"text": [
|
|
"<class 'stix2.v20.sdo.Identity'>\n"
|
|
]
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-5473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Cole Powers"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 7,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"input_dict = {\n",
|
|
" \"type\": \"identity\",\n",
|
|
" \"id\": \"identity--311b2d2d-f010-5473-83ec-1edf84858f4c\",\n",
|
|
" \"created\": \"2015-12-21T19:59:11Z\",\n",
|
|
" \"modified\": \"2015-12-21T19:59:11Z\",\n",
|
|
" \"name\": \"Cole Powers\",\n",
|
|
" \"identity_class\": \"individual\"\n",
|
|
"}\n",
|
|
"\n",
|
|
"obj = parse(input_dict)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"**Parsing a file-like object**"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": 8,
|
|
"metadata": {},
|
|
"outputs": [
|
|
{
|
|
"name": "stdout",
|
|
"output_type": "stream",
|
|
"text": [
|
|
"<class 'stix2.v20.sdo.CourseOfAction'>\n"
|
|
]
|
|
},
|
|
{
|
|
"data": {
|
|
"text/html": [
|
|
"<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n",
|
|
".highlight { background: #f8f8f8; }\n",
|
|
".highlight .c { color: #408080; font-style: italic } /* Comment */\n",
|
|
".highlight .err { border: 1px solid #FF0000 } /* Error */\n",
|
|
".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n",
|
|
".highlight .o { color: #666666 } /* Operator */\n",
|
|
".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n",
|
|
".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n",
|
|
".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n",
|
|
".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n",
|
|
".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n",
|
|
".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n",
|
|
".highlight .gd { color: #A00000 } /* Generic.Deleted */\n",
|
|
".highlight .ge { font-style: italic } /* Generic.Emph */\n",
|
|
".highlight .gr { color: #FF0000 } /* Generic.Error */\n",
|
|
".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n",
|
|
".highlight .gi { color: #00A000 } /* Generic.Inserted */\n",
|
|
".highlight .go { color: #888888 } /* Generic.Output */\n",
|
|
".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n",
|
|
".highlight .gs { font-weight: bold } /* Generic.Strong */\n",
|
|
".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n",
|
|
".highlight .gt { color: #0044DD } /* Generic.Traceback */\n",
|
|
".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n",
|
|
".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n",
|
|
".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n",
|
|
".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n",
|
|
".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n",
|
|
".highlight .kt { color: #B00040 } /* Keyword.Type */\n",
|
|
".highlight .m { color: #666666 } /* Literal.Number */\n",
|
|
".highlight .s { color: #BA2121 } /* Literal.String */\n",
|
|
".highlight .na { color: #7D9029 } /* Name.Attribute */\n",
|
|
".highlight .nb { color: #008000 } /* Name.Builtin */\n",
|
|
".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n",
|
|
".highlight .no { color: #880000 } /* Name.Constant */\n",
|
|
".highlight .nd { color: #AA22FF } /* Name.Decorator */\n",
|
|
".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n",
|
|
".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n",
|
|
".highlight .nf { color: #0000FF } /* Name.Function */\n",
|
|
".highlight .nl { color: #A0A000 } /* Name.Label */\n",
|
|
".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n",
|
|
".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n",
|
|
".highlight .nv { color: #19177C } /* Name.Variable */\n",
|
|
".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n",
|
|
".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n",
|
|
".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n",
|
|
".highlight .mf { color: #666666 } /* Literal.Number.Float */\n",
|
|
".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n",
|
|
".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n",
|
|
".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n",
|
|
".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n",
|
|
".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n",
|
|
".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n",
|
|
".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n",
|
|
".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n",
|
|
".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n",
|
|
".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n",
|
|
".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n",
|
|
".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n",
|
|
".highlight .sx { color: #008000 } /* Literal.String.Other */\n",
|
|
".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n",
|
|
".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n",
|
|
".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n",
|
|
".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n",
|
|
".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n",
|
|
".highlight .vc { color: #19177C } /* Name.Variable.Class */\n",
|
|
".highlight .vg { color: #19177C } /* Name.Variable.Global */\n",
|
|
".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n",
|
|
".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n",
|
|
".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n",
|
|
" <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created_by_ref"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2017-05-31T21:30:41.022Z"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"Data from Network Shared Drive Mitigation"</span><span class=\"p\">,</span>\n",
|
|
" <span class=\"nt\">"description"</span><span class=\"p\">:</span> <span class=\"s2\">"Identify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting[[CiteRef::Beechey 2010]] tools, like AppLocker,[[CiteRef::Windows Commands JPCERT]][[CiteRef::NSA MS AppLocker]] or Software Restriction Policies[[CiteRef::Corio 2008]] where appropriate.[[CiteRef::TechNet Applocker vs SRP]]"</span>\n",
|
|
"<span class=\"p\">}</span>\n",
|
|
"</pre></div>\n"
|
|
],
|
|
"text/plain": [
|
|
"<IPython.core.display.HTML object>"
|
|
]
|
|
},
|
|
"execution_count": 8,
|
|
"metadata": {},
|
|
"output_type": "execute_result"
|
|
}
|
|
],
|
|
"source": [
|
|
"file_handle = open(\"/home/michael/cti-python-stix2/stix2/test/stix2_data/course-of-action/course-of-action--d9727aee-48b8-4fdb-89e2-4c49746ba4dd.json\")\n",
|
|
"\n",
|
|
"obj = parse(file_handle)\n",
|
|
"print(type(obj))\n",
|
|
"print(obj)"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"## Parsing Custom STIX Content"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "markdown",
|
|
"metadata": {},
|
|
"source": [
|
|
"Parsing custom STIX objects and/or STIX objects with custom properties is also completed easily with [parse()](../api/stix2.core.rst#stix2.core.parse). Just supply the keyword argument *allow_custom=True*. When *allow_custom* is specified, [parse()](../api/stix2.core.rst#stix2.core.parse) will attempt to convert the supplied STIX content to known STIX2 domain objects and/or previously defined custom defined STIX2 objects. If the conversion cannot be completed (and *allow_custom* is specified), [parse()](../api/stix2.core.rst#stix2.core.parse) will treat the supplied STIX2 content as valid STIX2 objects and return them. **Warning: Specifying *allow_custom* may lead to critical errors if further processing (searching, filtering, modifying etc...) of the custom STIX2 content occurs where the custom STIX2 content supplied is not valid STIX2**. This is an axiomatic possibility as the STIX2 library cannot guarantee proper processing of unknown custom STIX2 objects that were explicitly flagged to be allowed, and thus may not be valid.\n",
|
|
"\n",
|
|
"For examples on parsing STIX2 objects with custom STIX properties, see [Custom STIX Content:Custom Properties](custom.ipynb#Custom-Properties)\n",
|
|
"\n",
|
|
"For examples on parsing defined custom STIX2 objects, see [Custom STIX Content: Custom STIX Object Types](custom.ipynb#Custom-STIX-Object-Types)\n",
|
|
"\n",
|
|
"For the case where it is desired to retrieve STIX2 content from a source (e.g. file system, TAXII) that may possibly have custom STIX2 content unknown to the user, the user can create a STIX2 DataStore/Source with the flag *allow_custom=True*. As aforementioned this will configure the DataStore/Source to allow for unknown STIX2 content to be returned (albeit not converted to full STIX2 domain objects and properties); notable processing capabilites of the STIX2 library may be precluded by the unknown STIX2 content, if the content is not valid or actual STIX2 domain objects and properties."
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"metadata": {
|
|
"collapsed": true
|
|
},
|
|
"outputs": [],
|
|
"source": [
|
|
"from taxii2client import Collection\n",
|
|
"from stix2 import CompositeDataSource, FileSystemSource, TAXIICollectionSource\n",
|
|
"\n",
|
|
"# to allow for the retrieval of unknown custom STIX2 content,\n",
|
|
"# just create *Stores/*Sources with the 'allow_custom' flag\n",
|
|
"\n",
|
|
"# create FileSystemStore\n",
|
|
"fs = FileSystemSource(\"/path/to/stix2_data/\", allow_custom=True)\n",
|
|
"\n",
|
|
"# create TAXIICollectionSource\n",
|
|
"colxn = Collection('http://taxii_url')\n",
|
|
"ts = TAXIICollectionSource(colxn, allow_custom=True)\n"
|
|
]
|
|
}
|
|
],
|
|
"metadata": {
|
|
"kernelspec": {
|
|
"display_name": "Python 2",
|
|
"language": "python",
|
|
"name": "python2"
|
|
},
|
|
"language_info": {
|
|
"codemirror_mode": {
|
|
"name": "ipython",
|
|
"version": 2
|
|
},
|
|
"file_extension": ".py",
|
|
"mimetype": "text/x-python",
|
|
"name": "python",
|
|
"nbconvert_exporter": "python",
|
|
"pygments_lexer": "ipython2",
|
|
"version": "2.7.12"
|
|
}
|
|
},
|
|
"nbformat": 4,
|
|
"nbformat_minor": 2
|
|
}
|