Exemple #1
0
def genObject_URI(data):
    from cybox.core.observable import Observables, Observable
    from cybox.utils import create_id as CyboxID
    from cybox.objects.uri_object import URI

    objURI = URI()
    objURI.idref = None
    objURI.properties = None
    objURI.related_objects = []
    objURI.domain_specific_object_properties = None
    objURI.value = escape(unicode(data['url']))
    objURI.value.condition = 'Equals'
    objURI.type_ = "URL"

    obsURI = Observable(objURI)
    obsURI.idref = None
    obsURI.object = None
    objURI = None
    obsURI.title = "URL: " + escape(unicode(data['url']))[:70] + "..."
    # sDscrpt = "URL: " + data['url'] + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
    # obsURI.description = "<![CDATA[" + sDscrpt + "]]>"
    # try:
    #     obsURI.description = "URL: " + escape(unicode(data['url'])) + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
    # except:
    #     obsURI.description = "URL: " + " --[URL Not Displayed - Due to encoding issue]-- " + "| isOnline:" + data['online'] + "| dateVerified:" + data['verification_time']
    obsURI.description = "URL: " + escape(data['url']) + "| isOnline:" + data[
        'online'] + "| dateVerified:" + data['verification_time']

    obsURI.event = None
    obsURI.observable_composition = None
    obsURI.sighting_count = 1
    obsURI.observable_source = []

    return (obsURI)
Exemple #2
0
def gen_stix_indicator_sample(
    config,
    target=None,
    datatype=None,
    title="random test data",
    description="random test data",
    package_intents="Indicators - Watchlist",
    tlp_color="WHITE",
    observables_list=None,
):
    """generate sample stix data comprised of indicator_count
    indicators of type datatype"""
    # setup the xmlns...
    xmlns_url = config["edge"]["sites"][target]["stix"]["xmlns_url"]
    xmlns_name = config["edge"]["sites"][target]["stix"]["xmlns_name"]
    set_stix_id_namespace({xmlns_url: xmlns_name})
    set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
    # construct a stix package...
    stix_package = STIXPackage()
    stix_header = STIXHeader()
    stix_header.title = title
    stix_header.description = description
    stix_header.package_intents = package_intents
    marking = MarkingSpecification()
    marking.controlled_structure = "../../../../descendant-or-self::node()"
    tlp_marking = TLPMarkingStructure()
    tlp_marking.color = tlp_color
    marking.marking_structures.append(tlp_marking)
    stix_package.stix_header = stix_header
    stix_package.stix_header.handling = Marking()
    stix_package.stix_header.handling.add_marking(marking)
    indicator_ = Indicator()
    indicator_.title = str(uuid.uuid4()) + "_sample_indicator"
    indicator_.confidence = "Unknown"
    indicator_.add_indicator_type("Malware Artifacts")
    observable_composition_ = ObservableComposition()
    observable_composition_.operator = indicator_.observable_composition_operator
    for observable_id in observables_list:
        observable_ = Observable()
        observable_.idref = observable_id
        observable_composition_.add(observable_)
    indicator_.observable = Observable()
    indicator_.observable.observable_composition = observable_composition_
    stix_package.add_indicator(indicator_)
    return stix_package
Exemple #3
0
def gen_stix_indicator_sample(config,
                              target=None,
                              datatype=None,
                              title='random test data',
                              description='random test data',
                              package_intents='Indicators - Watchlist',
                              tlp_color='WHITE',
                              observables_list=None):
    '''generate sample stix data comprised of indicator_count
    indicators of type datatype'''
    # setup the xmlns...
    xmlns_url = config['edge']['sites'][target]['stix']['xmlns_url']
    xmlns_name = config['edge']['sites'][target]['stix']['xmlns_name']
    set_stix_id_namespace({xmlns_url: xmlns_name})
    set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
    # construct a stix package...
    stix_package = STIXPackage()
    stix_header = STIXHeader()
    stix_header.title = title
    stix_header.description = description
    stix_header.package_intents = package_intents
    marking = MarkingSpecification()
    marking.controlled_structure = '../../../../descendant-or-self::node()'
    tlp_marking = TLPMarkingStructure()
    tlp_marking.color = tlp_color
    marking.marking_structures.append(tlp_marking)
    stix_package.stix_header = stix_header
    stix_package.stix_header.handling = Marking()
    stix_package.stix_header.handling.add_marking(marking)
    indicator_ = Indicator()
    indicator_.title = str(uuid.uuid4()) + '_sample_indicator'
    indicator_.confidence = 'Unknown'
    indicator_.add_indicator_type('Malware Artifacts')
    observable_composition_ = ObservableComposition()
    observable_composition_.operator = \
        indicator_.observable_composition_operator
    for observable_id in observables_list:
        observable_ = Observable()
        observable_.idref = observable_id
        observable_composition_.add(observable_)
    indicator_.observable = Observable()
    indicator_.observable.observable_composition = observable_composition_
    stix_package.add_indicator(indicator_)
    return (stix_package)
Exemple #4
0
def gen_stix_indicator_sample(config, target=None, datatype=None,
                              title='random test data',
                              description='random test data',
                              package_intents='Indicators - Watchlist',
                              tlp_color='WHITE', observables_list=None):
    '''generate sample stix data comprised of indicator_count
    indicators of type datatype'''
    # setup the xmlns...
    xmlns_url = config['edge']['sites'][target]['stix']['xmlns_url']
    xmlns_name = config['edge']['sites'][target]['stix']['xmlns_name']
    set_stix_id_namespace({xmlns_url: xmlns_name})
    set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
    # construct a stix package...
    stix_package = STIXPackage()
    stix_header = STIXHeader()
    stix_header.title = title
    stix_header.description = description
    stix_header.package_intents = package_intents
    marking = MarkingSpecification()
    marking.controlled_structure = '../../../../descendant-or-self::node()'
    tlp_marking = TLPMarkingStructure()
    tlp_marking.color = tlp_color
    marking.marking_structures.append(tlp_marking)
    stix_package.stix_header = stix_header
    stix_package.stix_header.handling = Marking()
    stix_package.stix_header.handling.add_marking(marking)
    indicator_ = Indicator()
    indicator_.title = str(uuid.uuid4()) + '_sample_indicator'
    indicator_.confidence = 'Unknown'
    indicator_.add_indicator_type('Malware Artifacts')
    observable_composition_ = ObservableComposition()
    observable_composition_.operator = \
        indicator_.observable_composition_operator
    for observable_id in observables_list:
        observable_ = Observable()
        observable_.idref = observable_id
        observable_composition_.add(observable_)
    indicator_.observable = Observable()
    indicator_.observable.observable_composition = observable_composition_
    stix_package.add_indicator(indicator_)
    return(stix_package)
Exemple #5
0
    def create_observable(self, ce1sus_obs, event_permissions, user):
        identifier = 'ce1sus:Observable-{0}'.format(ce1sus_obs.uuid)
        cybox_observable = Observable()
        if identifier in self.seen_observables:
            # if I've seen the uuid then make a reference insead
            cybox_observable.idref = identifier
        else:
            self.seen_observables.append(identifier)
            cybox_observable.id_ = identifier
            cybox_observable.title = ce1sus_obs.title
            cybox_observable.description = ce1sus_obs.description
            if ce1sus_obs.object:
                cybox_obj = self.create_object(ce1sus_obs.object,
                                               event_permissions, user)
                cybox_observable.object_ = cybox_obj
            elif ce1sus_obs.observable_composition:
                cybox_obj_composition = self.create_composed_observable(
                    ce1sus_obs.observable_composition, event_permissions, user)
                cybox_observable.observable_composition = cybox_obj_composition

        return cybox_observable
Exemple #6
0
def json2indicator(config, src, dest, endpoint, json_, crits_id):
    '''transform crits indicators into stix indicators with embedded
    cybox observable composition'''
    try:
        set_id_method(IDGenerator.METHOD_UUID)
        xmlns_url = config['edge']['sites'][dest]['stix']['xmlns_url']
        xmlns_name = config['edge']['sites'][dest]['stix']['xmlns_name']
        set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
        if endpoint == 'indicators':
            endpoint_trans = {'Email': 'emails', 'IP': 'ips',
                              'Sample': 'samples', 'Domain': 'domains', 
                              'Indicator': 'indicators', 'Event': 'events'}
            if json_.get('type', None) not in ['Reference', 'Related_To']:
                config['logger'].error(
                    log.log_messages['unsupported_object_error'].format(
                        type_='crits', obj_type='indicator type ' + json_.get('type', 'None'),
                        id_=crits_id))
                return(None)
            indicator_ = Indicator()
            indicator_.id = xmlns_name + ':indicator-' + crits_id
            indicator_.id_ = indicator_.id
            indicator_.title = json_['value']
            indicator_.confidence = json_['confidence']['rating'].capitalize()
            indicator_.add_indicator_type('Malware Artifacts')
            observable_composition_ = ObservableComposition()
            observable_composition_.operator = \
                indicator_.observable_composition_operator
            for r in json_['relationships']:
                if r.get('relationship', None) not in ['Contains', 'Related_To']:
                    config['logger'].error(
                        log.log_messages['unsupported_object_error'].format(
                            type_='crits', obj_type='indicator relationship type '
                            + r.get('relationship', 'None'), id_=crits_id))
                    continue
                if r['type'] in ['Sample', 'Email', 'IP', 'Sample', 'Domain']:
                    observable_ = Observable()
                    observable_.idref = xmlns_name + ':observable-' + r['value']
                    observable_composition_.add(observable_)
                elif r['type'] == 'Indicator':
                    related_indicator = RelatedIndicator(Indicator(idref=xmlns_name + ':indicator-' + r['value']))
                    indicator_.related_indicators.append(related_indicator)
                # stix indicators don't support related_incident :-(
                # elif r['type'] == 'Event':
                #     related_incident = RelatedIncident(Incident(idref=xmlns_name + ':incident-' + r['value']))
                #     indicator_.related_incidents.append(related_incident)
            indicator_.observable = Observable()
            indicator_.observable.observable_composition = \
                observable_composition_
            return(indicator_)
        else:
            config['logger'].error(
                log.log_messages['unsupported_object_error'].format(
                    type_='crits', obj_type=endpoint, id_=crits_id))
            return(None)
    except:
        e = sys.exc_info()[0]
        config['logger'].error(log.log_messages['obj_convert_error'].format(
            src_type='crits', src_obj='indicator', id_=crits_id,
            dest_type='stix', dest_obj='indicator'))
        config['logger'].exception(e)
        return(None)
Exemple #7
0
def json2indicator(config, src, dest, endpoint, json_, crits_id):
    '''transform crits indicators into stix indicators with embedded
    cybox observable composition'''
    try:
        set_id_method(IDGenerator.METHOD_UUID)
        xmlns_url = config['edge']['sites'][dest]['stix']['xmlns_url']
        xmlns_name = config['edge']['sites'][dest]['stix']['xmlns_name']
        set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
        if endpoint == 'indicators':
            endpoint_trans = {
                'Email': 'emails',
                'IP': 'ips',
                'Sample': 'samples',
                'Domain': 'domains',
                'Indicator': 'indicators',
                'Event': 'events'
            }
            if json_.get('type', None) not in ['Reference', 'Related_To']:
                config['logger'].error(
                    log.log_messages['unsupported_object_error'].format(
                        type_='crits',
                        obj_type='indicator type ' + json_.get('type', 'None'),
                        id_=crits_id))
                return (None)
            indicator_ = Indicator()
            indicator_.id = xmlns_name + ':indicator-' + crits_id
            indicator_.id_ = indicator_.id
            indicator_.title = json_['value']
            indicator_.confidence = json_['confidence']['rating'].capitalize()
            indicator_.add_indicator_type('Malware Artifacts')
            observable_composition_ = ObservableComposition()
            observable_composition_.operator = \
                indicator_.observable_composition_operator
            for r in json_['relationships']:
                if r.get('relationship',
                         None) not in ['Contains', 'Related_To']:
                    config['logger'].error(
                        log.log_messages['unsupported_object_error'].format(
                            type_='crits',
                            obj_type='indicator relationship type ' +
                            r.get('relationship', 'None'),
                            id_=crits_id))
                    continue
                if r['type'] in ['Sample', 'Email', 'IP', 'Sample', 'Domain']:
                    observable_ = Observable()
                    observable_.idref = xmlns_name + ':observable-' + r['value']
                    observable_composition_.add(observable_)
                elif r['type'] == 'Indicator':
                    related_indicator = RelatedIndicator(
                        Indicator(idref=xmlns_name + ':indicator-' +
                                  r['value']))
                    indicator_.related_indicators.append(related_indicator)
                # stix indicators don't support related_incident :-(
                # elif r['type'] == 'Event':
                #     related_incident = RelatedIncident(Incident(idref=xmlns_name + ':incident-' + r['value']))
                #     indicator_.related_incidents.append(related_incident)
            indicator_.observable = Observable()
            indicator_.observable.observable_composition = \
                observable_composition_
            return (indicator_)
        else:
            config['logger'].error(
                log.log_messages['unsupported_object_error'].format(
                    type_='crits', obj_type=endpoint, id_=crits_id))
            return (None)
    except:
        e = sys.exc_info()[0]
        config['logger'].error(log.log_messages['obj_convert_error'].format(
            src_type='crits',
            src_obj='indicator',
            id_=crits_id,
            dest_type='stix',
            dest_obj='indicator'))
        config['logger'].exception(e)
        return (None)
Exemple #8
0
def genRefObs(data):
    from cybox.core.observable import Observable
    refObs = Observable()
    refObs.id_ = None
    refObs.idref = data.id_
    return (refObs)