def get_indicator_from_json(indicator_json, user_timezone):
type_ = indicator_json['type']
v = indicator_json['value']
title = indicator_json['title']
o_ = None
# ipv4か?
if type_ == JSON_OBJECT_TYPE_IPV4:
o_ = Address()
o_.address_value = v.replace('[', '').replace(']', '')
# urlか?
if type_ == JSON_OBJECT_TYPE_URI:
o_ = URI()
o_.value = v
# md5か?
if type_ == JSON_OBJECT_TYPE_MD5:
o_ = File()
o_.md5 = v
# sha1か?
if type_ == JSON_OBJECT_TYPE_SHA1:
o_ = File()
o_.sha1 = v
# sha256か?
if type_ == JSON_OBJECT_TYPE_SHA256:
o_ = File()
o_.sha256 = v
# sha512か?
if type_ == JSON_OBJECT_TYPE_SHA512:
o_ = File()
o_.sha512 = v
# email-addressか?
if type_ == JSON_OBJECT_TYPE_EMAIL_ADDRESS:
o_ = EmailAddress()
o_.address_value = v
# domainか?
if type_ == JSON_OBJECT_TYPE_DOMAIN:
o_ = DomainName()
o_.value = v.replace('[', '').replace(']', '')
# file名か?
if type_ == JSON_OBJECT_TYPE_FILE_NAME:
o_ = File()
o_.file_name = v
# なにも該当していないので None
if o_ is None:
print('何も該当なし:' + str(type_) + ':' + str(v))
return None
# indicator 作って返却
indicator_title = '%s (%s)' % (v, title)
ind = CommonExtractor.get_indicator_from_object(
o_, indicator_title, user_timezone)
return ind
