def genObject_URI(data):
from cybox.core.observable import Observables, Observable
from cybox.utils import create_id as CyboxID
from cybox.objects.uri_object import URI
objURI = URI()
objURI.idref = None
objURI.properties = None
objURI.related_objects = []
objURI.domain_specific_object_properties = None
objURI.value = escape(unicode(data['url']))
objURI.value.condition = 'Equals'
objURI.type_ = "URL"
obsURI = Observable(objURI)
obsURI.idref = None
obsURI.object = None
objURI = None
obsURI.title = "URL: " + escape(unicode(data['url']))[:70] + "..."
# sDscrpt = "URL: " + data['url'] + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
# obsURI.description = "<![CDATA[" + sDscrpt + "]]>"
# try:
# obsURI.description = "URL: " + escape(unicode(data['url'])) + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
# except:
# obsURI.description = "URL: " + " --[URL Not Displayed - Due to encoding issue]-- " + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
obsURI.description = "URL: " + escape(data['url']) + "| isOnline:" + data[
'online'] + "| dateVerified:" + data['verification_time']
obsURI.event = None
obsURI.observable_composition = None
obsURI.sighting_count = 1
obsURI.observable_source = []
return (obsURI)
def gen_stix_indicator_sample(
config,
target=None,
datatype=None,
title="random test data",
description="random test data",
package_intents="Indicators - Watchlist",
tlp_color="WHITE",
observables_list=None,
):
"""generate sample stix data comprised of indicator_count
indicators of type datatype"""
# setup the xmlns...
xmlns_url = config["edge"]["sites"][target]["stix"]["xmlns_url"]
xmlns_name = config["edge"]["sites"][target]["stix"]["xmlns_name"]
set_stix_id_namespace({xmlns_url: xmlns_name})
set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
# construct a stix package...
stix_package = STIXPackage()
stix_header = STIXHeader()
stix_header.title = title
stix_header.description = description
stix_header.package_intents = package_intents
marking = MarkingSpecification()
marking.controlled_structure = "../../../../descendant-or-self::node()"
tlp_marking = TLPMarkingStructure()
tlp_marking.color = tlp_color
marking.marking_structures.append(tlp_marking)
stix_package.stix_header = stix_header
stix_package.stix_header.handling = Marking()
stix_package.stix_header.handling.add_marking(marking)
indicator_ = Indicator()
indicator_.title = str(uuid.uuid4()) + "_sample_indicator"
indicator_.confidence = "Unknown"
indicator_.add_indicator_type("Malware Artifacts")
observable_composition_ = ObservableComposition()
observable_composition_.operator = indicator_.observable_composition_operator
for observable_id in observables_list:
observable_ = Observable()
observable_.idref = observable_id
observable_composition_.add(observable_)
indicator_.observable = Observable()
indicator_.observable.observable_composition = observable_composition_
stix_package.add_indicator(indicator_)
return stix_package
def gen_stix_indicator_sample(config,
target=None,
datatype=None,
title='random test data',
description='random test data',
package_intents='Indicators - Watchlist',
tlp_color='WHITE',
observables_list=None):
'''generate sample stix data comprised of indicator_count
indicators of type datatype'''
# setup the xmlns...
xmlns_url = config['edge']['sites'][target]['stix']['xmlns_url']
xmlns_name = config['edge']['sites'][target]['stix']['xmlns_name']
set_stix_id_namespace({xmlns_url: xmlns_name})
set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
# construct a stix package...
stix_package = STIXPackage()
stix_header = STIXHeader()
stix_header.title = title
stix_header.description = description
stix_header.package_intents = package_intents
marking = MarkingSpecification()
marking.controlled_structure = '../../../../descendant-or-self::node()'
tlp_marking = TLPMarkingStructure()
tlp_marking.color = tlp_color
marking.marking_structures.append(tlp_marking)
stix_package.stix_header = stix_header
stix_package.stix_header.handling = Marking()
stix_package.stix_header.handling.add_marking(marking)
indicator_ = Indicator()
indicator_.title = str(uuid.uuid4()) + '_sample_indicator'
indicator_.confidence = 'Unknown'
indicator_.add_indicator_type('Malware Artifacts')
observable_composition_ = ObservableComposition()
observable_composition_.operator = \
indicator_.observable_composition_operator
for observable_id in observables_list:
observable_ = Observable()
observable_.idref = observable_id
observable_composition_.add(observable_)
indicator_.observable = Observable()
indicator_.observable.observable_composition = observable_composition_
stix_package.add_indicator(indicator_)
return (stix_package)
def gen_stix_indicator_sample(config, target=None, datatype=None,
title='random test data',
description='random test data',
package_intents='Indicators - Watchlist',
tlp_color='WHITE', observables_list=None):
'''generate sample stix data comprised of indicator_count
indicators of type datatype'''
# setup the xmlns...
xmlns_url = config['edge']['sites'][target]['stix']['xmlns_url']
xmlns_name = config['edge']['sites'][target]['stix']['xmlns_name']
set_stix_id_namespace({xmlns_url: xmlns_name})
set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
# construct a stix package...
stix_package = STIXPackage()
stix_header = STIXHeader()
stix_header.title = title
stix_header.description = description
stix_header.package_intents = package_intents
marking = MarkingSpecification()
marking.controlled_structure = '../../../../descendant-or-self::node()'
tlp_marking = TLPMarkingStructure()
tlp_marking.color = tlp_color
marking.marking_structures.append(tlp_marking)
stix_package.stix_header = stix_header
stix_package.stix_header.handling = Marking()
stix_package.stix_header.handling.add_marking(marking)
indicator_ = Indicator()
indicator_.title = str(uuid.uuid4()) + '_sample_indicator'
indicator_.confidence = 'Unknown'
indicator_.add_indicator_type('Malware Artifacts')
observable_composition_ = ObservableComposition()
observable_composition_.operator = \
indicator_.observable_composition_operator
for observable_id in observables_list:
observable_ = Observable()
observable_.idref = observable_id
observable_composition_.add(observable_)
indicator_.observable = Observable()
indicator_.observable.observable_composition = observable_composition_
stix_package.add_indicator(indicator_)
return(stix_package)
def create_observable(self, ce1sus_obs, event_permissions, user):
identifier = 'ce1sus:Observable-{0}'.format(ce1sus_obs.uuid)
cybox_observable = Observable()
if identifier in self.seen_observables:
# if I've seen the uuid then make a reference insead
cybox_observable.idref = identifier
else:
self.seen_observables.append(identifier)
cybox_observable.id_ = identifier
cybox_observable.title = ce1sus_obs.title
cybox_observable.description = ce1sus_obs.description
if ce1sus_obs.object:
cybox_obj = self.create_object(ce1sus_obs.object,
event_permissions, user)
cybox_observable.object_ = cybox_obj
elif ce1sus_obs.observable_composition:
cybox_obj_composition = self.create_composed_observable(
ce1sus_obs.observable_composition, event_permissions, user)
cybox_observable.observable_composition = cybox_obj_composition
return cybox_observable
def json2indicator(config, src, dest, endpoint, json_, crits_id):
'''transform crits indicators into stix indicators with embedded
cybox observable composition'''
try:
set_id_method(IDGenerator.METHOD_UUID)
xmlns_url = config['edge']['sites'][dest]['stix']['xmlns_url']
xmlns_name = config['edge']['sites'][dest]['stix']['xmlns_name']
set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
if endpoint == 'indicators':
endpoint_trans = {'Email': 'emails', 'IP': 'ips',
'Sample': 'samples', 'Domain': 'domains',
'Indicator': 'indicators', 'Event': 'events'}
if json_.get('type', None) not in ['Reference', 'Related_To']:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits', obj_type='indicator type ' + json_.get('type', 'None'),
id_=crits_id))
return(None)
indicator_ = Indicator()
indicator_.id = xmlns_name + ':indicator-' + crits_id
indicator_.id_ = indicator_.id
indicator_.title = json_['value']
indicator_.confidence = json_['confidence']['rating'].capitalize()
indicator_.add_indicator_type('Malware Artifacts')
observable_composition_ = ObservableComposition()
observable_composition_.operator = \
indicator_.observable_composition_operator
for r in json_['relationships']:
if r.get('relationship', None) not in ['Contains', 'Related_To']:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits', obj_type='indicator relationship type '
+ r.get('relationship', 'None'), id_=crits_id))
continue
if r['type'] in ['Sample', 'Email', 'IP', 'Sample', 'Domain']:
observable_ = Observable()
observable_.idref = xmlns_name + ':observable-' + r['value']
observable_composition_.add(observable_)
elif r['type'] == 'Indicator':
related_indicator = RelatedIndicator(Indicator(idref=xmlns_name + ':indicator-' + r['value']))
indicator_.related_indicators.append(related_indicator)
# stix indicators don't support related_incident :-(
# elif r['type'] == 'Event':
# related_incident = RelatedIncident(Incident(idref=xmlns_name + ':incident-' + r['value']))
# indicator_.related_incidents.append(related_incident)
indicator_.observable = Observable()
indicator_.observable.observable_composition = \
observable_composition_
return(indicator_)
else:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits', obj_type=endpoint, id_=crits_id))
return(None)
except:
e = sys.exc_info()[0]
config['logger'].error(log.log_messages['obj_convert_error'].format(
src_type='crits', src_obj='indicator', id_=crits_id,
dest_type='stix', dest_obj='indicator'))
config['logger'].exception(e)
return(None)
def json2indicator(config, src, dest, endpoint, json_, crits_id):
'''transform crits indicators into stix indicators with embedded
cybox observable composition'''
try:
set_id_method(IDGenerator.METHOD_UUID)
xmlns_url = config['edge']['sites'][dest]['stix']['xmlns_url']
xmlns_name = config['edge']['sites'][dest]['stix']['xmlns_name']
set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
if endpoint == 'indicators':
endpoint_trans = {
'Email': 'emails',
'IP': 'ips',
'Sample': 'samples',
'Domain': 'domains',
'Indicator': 'indicators',
'Event': 'events'
}
if json_.get('type', None) not in ['Reference', 'Related_To']:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits',
obj_type='indicator type ' + json_.get('type', 'None'),
id_=crits_id))
return (None)
indicator_ = Indicator()
indicator_.id = xmlns_name + ':indicator-' + crits_id
indicator_.id_ = indicator_.id
indicator_.title = json_['value']
indicator_.confidence = json_['confidence']['rating'].capitalize()
indicator_.add_indicator_type('Malware Artifacts')
observable_composition_ = ObservableComposition()
observable_composition_.operator = \
indicator_.observable_composition_operator
for r in json_['relationships']:
if r.get('relationship',
None) not in ['Contains', 'Related_To']:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits',
obj_type='indicator relationship type ' +
r.get('relationship', 'None'),
id_=crits_id))
continue
if r['type'] in ['Sample', 'Email', 'IP', 'Sample', 'Domain']:
observable_ = Observable()
observable_.idref = xmlns_name + ':observable-' + r['value']
observable_composition_.add(observable_)
elif r['type'] == 'Indicator':
related_indicator = RelatedIndicator(
Indicator(idref=xmlns_name + ':indicator-' +
r['value']))
indicator_.related_indicators.append(related_indicator)
# stix indicators don't support related_incident :-(
# elif r['type'] == 'Event':
# related_incident = RelatedIncident(Incident(idref=xmlns_name + ':incident-' + r['value']))
# indicator_.related_incidents.append(related_incident)
indicator_.observable = Observable()
indicator_.observable.observable_composition = \
observable_composition_
return (indicator_)
else:
config['logger'].error(
log.log_messages['unsupported_object_error'].format(
type_='crits', obj_type=endpoint, id_=crits_id))
return (None)
except:
e = sys.exc_info()[0]
config['logger'].error(log.log_messages['obj_convert_error'].format(
src_type='crits',
src_obj='indicator',
id_=crits_id,
dest_type='stix',
dest_obj='indicator'))
config['logger'].exception(e)
return (None)
def genRefObs(data):
from cybox.core.observable import Observable
refObs = Observable()
refObs.id_ = None
refObs.idref = data.id_
return (refObs)