Exemple #1
0
    def add_raw_indicator(self , orig_indicator, ts=None):
        indicator_value = orig_indicator
        if not self._is_ascii(indicator_value):
            return False

        indicator_type, _ = guess_type(indicator_value)
        # Create a CyboX File Object
        if indicator_type == StixItemType.IPADDR:
            title = "Malicious IPv4 - %s" % indicator_value
            descr = "Malicious IPv4 involved with %s" % self._pkg.stix_header.title
            cybox = Address(indicator_value , Address.CAT_IPV4)
        elif indicator_type == StixItemType.DOMAIN:
            title = "Malicious domain - %s" % indicator_value
            descr = "Malicious domain involved with %s" % self._pkg.stix_header.title
            cybox = DomainName()
            cybox.value = indicator_value
        elif indicator_type == StixItemType.MD5:
            title = "Malicious MD5 - %s" % indicator_value
            descr = "Malicious MD5 involved with %s" % self._pkg.stix_header.title
            cybox = File()
            cybox.add_hash(indicator_value )
        elif indicator_type == StixItemType.SHA256:
            title = "Malicious SHA256 - %s" % indicator_value
            descr = "Malicious SHA256 involved with %s" % self._pkg.stix_header.title
            cybox = File()
            cybox.add_hash(indicator_value )
        elif indicator_type == StixItemType.SHA1:
            title = "Malicious SHA1 - %s" % indicator_value
            descr = "Malicious SHA1 involved with %s" % self._pkg.stix_header.title
            cybox = File()
            cybox.add_hash(indicator_value )
        elif indicator_type == StixItemType.URL:
            title = "Malicious URL - %s" % indicator_value
            descr = "Malicious URL involved with %s" % self._pkg.stix_header.title
            cybox = URI()
            cybox.value = indicator_value
            cybox.type_ = URI.TYPE_URL

        if indicator_type == StixItemType.UNKNOWN:
            return False

        indicator = Indicator()
        indicator.title = title
        indicator.description = descr
        indicator.add_object(cybox)
        indicator.set_producer_identity(self.__author)
        if ts:
            indicator.set_produced_time(ts)
        else:
            indicator.set_produced_time(utils.dates.now())

        self._add(indicator)
        return True
Exemple #2
0
    def get_indicator_from_json(indicator_json, user_timezone):
        type_ = indicator_json['type']
        v = indicator_json['value']
        title = indicator_json['title']
        o_ = None

        # ipv4か?
        if type_ == JSON_OBJECT_TYPE_IPV4:
            o_ = Address()
            o_.address_value = v.replace('[', '').replace(']', '')

        # urlか?
        if type_ == JSON_OBJECT_TYPE_URI:
            o_ = URI()
            o_.value = v

        # md5か?
        if type_ == JSON_OBJECT_TYPE_MD5:
            o_ = File()
            o_.md5 = v

        # sha1か?
        if type_ == JSON_OBJECT_TYPE_SHA1:
            o_ = File()
            o_.sha1 = v

        # sha256か?
        if type_ == JSON_OBJECT_TYPE_SHA256:
            o_ = File()
            o_.sha256 = v

        # sha512か?
        if type_ == JSON_OBJECT_TYPE_SHA512:
            o_ = File()
            o_.sha512 = v

        # email-addressか?
        if type_ == JSON_OBJECT_TYPE_EMAIL_ADDRESS:
            o_ = EmailAddress()
            o_.address_value = v

        # domainか?
        if type_ == JSON_OBJECT_TYPE_DOMAIN:
            o_ = DomainName()
            o_.value = v.replace('[', '').replace(']', '')

        # file名か?
        if type_ == JSON_OBJECT_TYPE_FILE_NAME:
            o_ = File()
            o_.file_name = v

        # なにも該当していないので None
        if o_ is None:
            print('何も該当なし:' + str(type_) + ':' + str(v))
            return None

        # indicator 作って返却
        indicator_title = '%s (%s)' % (v, title)
        ind = CommonExtractor.get_indicator_from_object(
            o_, indicator_title, user_timezone)
        return ind
def generate_stix_file(input_file, list_type, delimiter, list_name, tc_name, tmp_dir, validate, verbose):
	# observable limit per generated stix file
	OBSERVABLES_PER_STIX_FILE = 3000

	if verbose:
		logging.info("=====================")
		logging.info("== GENERATING STIX ==")
		logging.info("=====================")
	
	# download or open input file
	if validators.url(input_file):
		res = requests.get(input_file)
		items = res.text.split(delimiter)
	else:
		# exit if input file doesn't exist
		if not os.path.isfile(input_file):
			logging.error("Supplied input file '{}' doesn't exist".format(input_file))
			sys.exit("Error: Supplied input file '{}' doesn't exist".format(input_file))
		else:
			with open(input_file, 'r') as f:
				items = f.read().split(delimiter)
	logging.info("Successfully parsed input file at {}".format(input_file))

	# slice input into batches
	for batch_num, index in enumerate(range(0, len(items), OBSERVABLES_PER_STIX_FILE), 1):
		# slice handles out of bounds indices gracefully
		batch_items = items[index:index + OBSERVABLES_PER_STIX_FILE]

		# create the STIX Package
		package = STIXPackage()

		# create the STIX Header and add a description
		header = STIXHeader()
		package.stix_header = header

		reporttime = datetime.datetime.utcnow().strftime('%m/%d/%Y %H:%M:%S %Z')

		# create indicator for each item in the batch
		for item in batch_items:
			item = item.strip()

			# basic filtering of empty items and comments
			if not item or item.startswith(('#', '//', '--')):
				continue

			if list_type == 'ip':
				indicator_obj = Address()
				# attempt to parse as an ip address
				try:
					parsed_ip = ipaddress.ip_address(item)
					if parsed_ip.version == 4:
						indicator_obj.category = Address.CAT_IPV4
					elif parsed_ip.version == 6:
						indicator_obj.category = Address.CAT_IPV6
					else:
						logging.warning("Unknown IP Address version type: {} - skipping".format(parsed_ip.version))
						continue
				except ValueError:
					# if ip address parsing fails then attempt to parse as an ip network
					try:
						parsed_ip = ipaddress.ip_network(item, strict=False)
						indicator_obj.category = Address.CAT_CIDR
					except ValueError:
						logging.warning("IP Address {} is neither an IPv4, IPv6, nor CIDR - skipping".format(item))
						continue
				indicator_obj.address_value = str(parsed_ip)
				indicator_obj.condition = "Equals"
				indicator_type = "IP Watchlist"
				# customizable components below
				indicator_title = "IP: {}"
				indicator_description = "IP {} reported from {}"
			elif list_type == 'domain':
				# validate domain
				if validate and not validators.domain(item):
					logging.warning("Invalid domain: {} - skipping".format(item))
					continue
				indicator_obj = DomainName()
				indicator_obj.value = item
				indicator_type = "Domain Watchlist"
				# customizable components below
				indicator_title = "Domain: {}"
				indicator_description = "Domain {} reported from {}"
			elif list_type == 'url':
				# validate url
				if validate and not validators.url(item):
					logging.warning("Invalid url: {} - skipping".format(item))
					continue
				indicator_obj = URI()
				indicator_obj.value = item
				indicator_obj.type_ =  URI.TYPE_URL
				indicator_obj.condition = "Equals"
				indicator_type = "URL Watchlist"
				# customizable components below
				indicator_title = "URL: {}"
				indicator_description = "URL {} reported from {}"
			else:
				# invalid input type
				logging.error("invalid input type encountered")
				raise Exception('Error: invalid input type encountered')

			# create a basic Indicator object from the item
			indicator = Indicator()
			indicator.title = indicator_title.format(str(item))
			indicator.description = indicator_description.format(str(item), list_name)
			indicator.add_indicator_type(indicator_type)
			indicator.set_producer_identity(list_name)
			indicator.set_produced_time(str(reporttime))
			indicator.add_observable(indicator_obj)

			# add the indicator to the stix package
			package.add_indicator(indicator)

		# save each batch in a separate stix file with the filename ending ..._part_N.stix
		collection_filename = "{}_part_{}.stix".format(strip_non_alphanum(tc_name), batch_num)
		with open(os.path.join(tmp_dir, collection_filename), 'wb') as f:
			f.write(package.to_xml())
		logging.info("Successfully created stix file {}".format(collection_filename))

		# clear cybox cache to prevent an Out of Memory error
		# https://cybox.readthedocs.io/en/stable/api/cybox/core/object.html#cybox.core.object.Object
		cache_clear()
			
	return