def test_round_trip_manual(self):
text = StructuredText()
text.value = "some text"
text.structuring_format = "plain"
text2 = cybox.test.round_trip(text)
self.assertEqual(text.to_dict(), text2.to_dict())
def test_round_trip(self):
text = StructuredText()
text.value = "some text"
text.structuring_format = "plain"
text2 = cybox.test.round_trip(text)
self.assertEqual(text.to_dict(), text2.to_dict())
def from_dict(analysis_dict):
if not analysis_dict:
return None
analysis_ = Analysis(None)
analysis_.id = analysis_dict.get("id")
analysis_.method = analysis_dict.get("method")
analysis_.type = analysis_dict.get("type")
analysis_.ordinal_position = analysis_dict.get("ordinal_position")
analysis_.complete_datetime = analysis_dict.get("complete_datetime")
analysis_.start_datetime = analysis_dict.get("start_datetime")
analysis_.lastupdate_datetime = analysis_dict.get("lastupdate_datetime")
analysis_.source = Source.from_dict(analysis_dict.get("source"))
analysis_.analysts = Personnel.from_list(analysis_dict.get("analysts"))
analysis_.summary = StructuredText.from_dict(analysis_dict.get("summary"))
analysis_.comments = CommentList.from_list(analysis_dict.get("comments"))
if analysis_dict.get("findings_bundle_reference"):
analysis_.findings_bundle_reference = [
BundleReference.from_dict(x) for x in analysis_dict.get("findings_bundle_reference")
]
analysis_.tools = ToolList.from_list(analysis_dict.get("tools", []))
analysis_.dynamic_analysis_metadata = DynamicAnalysisMetadata.from_dict(
analysis_dict.get("dynamic_analysis_metadata")
)
analysis_.analysis_environment = AnalysisEnvironment.from_dict(analysis_dict.get("analysis_environment"))
analysis_.report = StructuredText.from_dict(analysis_dict.get("report"))
return analysis_
def from_obj(analysis_obj):
if not analysis_obj:
return None
analysis_ = Analysis(None)
analysis_.id = analysis_obj.get_id()
analysis_.method = analysis_obj.get_method()
analysis_.type = analysis_obj.get_type()
analysis_.ordinal_position = analysis_obj.get_ordinal_position()
analysis_.complete_datetime = analysis_obj.get_complete_datetime()
analysis_.start_datetime = analysis_obj.get_start_datetime()
analysis_.lastupdate_datetime = analysis_obj.get_lastupdate_datetime()
analysis_.source = Source.from_obj(analysis_obj.get_Source())
analysis_.analysts = Personnel.from_obj(analysis_obj.get_Analysts())
analysis_.summary = StructuredText.from_obj(analysis_obj.get_Summary())
analysis_.comments = CommentList.from_obj(analysis_obj.get_Comments())
if analysis_obj.get_Findings_Bundle_Reference():
analysis_.findings_bundle_reference = [
BundleReference.from_obj(x) for x in analysis_obj.get_Findings_Bundle_Reference()
]
analysis_.tools = ToolList.from_obj(analysis_obj.get_Tools())
analysis_.dynamic_analysis_metadata = DynamicAnalysisMetadata.from_obj(
analysis_obj.get_Dynamic_Analysis_Metadata()
)
analysis_.analysis_environment = AnalysisEnvironment.from_obj(analysis_obj.get_Analysis_Environment())
analysis_.report = StructuredText.from_obj(analysis_obj.get_Report())
return analysis_
def test_plain(self):
text = StructuredText.from_dict("a string")
text2 = cybox.test.round_trip(text)
self.assertEqual(text.to_dict(), text2.to_dict())
text_dict = {'value': "a string"}
text3 = StructuredText.from_dict(text_dict)
self.assertEqual(text.to_dict(), text3.to_dict())
def test_plain(self):
text = StructuredText.from_dict("a string")
text2 = cybox.test.round_trip(text)
self.assertEqual(text.to_dict(), text2.to_dict())
text_dict = {'value': "a string"}
text3 = StructuredText.from_dict(text_dict)
self.assertEqual(text.to_dict(), text3.to_dict())
def from_dict(platform_specification_dict):
if not platform_specification_dict:
return None
platform_specification_ = PlatformSpecification()
platform_specification_.description = StructuredText.from_dict(platform_specification_dict.get('description'))
platform_specification_.identifiers = [PlatformIdentifier.from_dict(x) for x in platform_specification_dict.get('identifiers',[])]
return platform_specification_
def from_dict(observable_dict):
if not observable_dict:
return None
from cybox.core import PatternFidelity
obs = Observable()
obs.id_ = observable_dict.get('id')
obs.title = observable_dict.get('title')
obs.description = StructuredText.from_dict(
observable_dict.get('description'))
obs.object_ = Object.from_dict(observable_dict.get('object'))
obs.event = Object.from_dict(observable_dict.get('event'))
obs.observable_composition = ObservableComposition.from_dict(
observable_dict.get('observable_composition'))
obs.idref = observable_dict.get('idref')
obs.sighting_count = observable_dict.get('sighting_count')
if observable_dict.get('observable_source'):
obs.observable_source = [
MeasureSource.from_dict(x)
for x in observable_dict.get('observable_source')
]
obs.keywords = Keywords.from_dict(observable_dict.get('keywords'))
obs.pattern_fidelity = PatternFidelity.from_dict(
observable_dict.get('pattern_fidelity'))
return obs
def from_obj(observable_obj):
if not observable_obj:
return None
from cybox.core import PatternFidelity
obs = Observable()
obs.id_ = observable_obj.id
obs.title = observable_obj.Title
obs.description = StructuredText.from_obj(observable_obj.Description)
obs.object_ = Object.from_obj(observable_obj.Object)
obs.event = Event.from_obj(observable_obj.Event)
obs.observable_composition = ObservableComposition.from_obj(
observable_obj.Observable_Composition)
obs.idref = observable_obj.idref
obs.sighting_count = observable_obj.sighting_count
if observable_obj.Observable_Source:
obs.observable_source = [
MeasureSource.from_obj(x)
for x in observable_obj.Observable_Source
]
obs.keywords = Keywords.from_obj(observable_obj.Keywords)
obs.pattern_fidelity = PatternFidelity.from_obj(
observable_obj.Pattern_Fidelity)
return obs
def from_obj(platform_specification_obj):
if not platform_specification_obj:
return None
platform_specification_ = PlatformSpecification()
platform_specification_.description = StructuredText.from_obj(platform_specification_obj.Description)
platform_specification_.identifiers = [PlatformIdentifier.from_obj(x) for x in platform_specification_obj.Identifier]
return platform_specification_
def from_dict(platform_specification_dict):
if not platform_specification_dict:
return None
platform_specification_ = PlatformSpecification()
platform_specification_.description = StructuredText.from_dict(platform_specification_dict.get('description'))
platform_specification_.identifiers = [PlatformIdentifier.from_dict(x) for x in platform_specification_dict.get('identifiers',[])]
return platform_specification_
def from_obj(platform_specification_obj):
if not platform_specification_obj:
return None
platform_specification_ = PlatformSpecification()
platform_specification_.description = StructuredText.from_obj(platform_specification_obj.get_Description())
platform_specification_.identifiers = [PlatformIdentifier.from_obj(x) for x in platform_specification_obj.get_Identifier()]
return platform_specification_
def from_dict(toolinfo_dict, tool_class=None):
if not toolinfo_dict:
return None
if not tool_class:
toolinfo = ToolInformation()
else:
toolinfo = tool_class
toolinfo.id_ = toolinfo_dict.get('id')
toolinfo.idref = toolinfo_dict.get('idref')
toolinfo.name = toolinfo_dict.get('name')
toolinfo.type_ = [
ToolType.from_dict(x) for x in toolinfo_dict.get('type', [])
]
toolinfo.description = StructuredText.from_dict(
toolinfo_dict.get('description'))
toolinfo.vendor = toolinfo_dict.get('vendor')
toolinfo.version = toolinfo_dict.get('version')
toolinfo.service_pack = toolinfo_dict.get('service_pack')
toolinfo.tool_hashes = HashList.from_list(
toolinfo_dict.get('tool_hashes'))
return toolinfo
def test_description_output(self):
incident = incident_binding.IncidentType()
assets = incident_binding.AffectedAssetsType()
asset = incident_binding.AffectedAssetType()
description = StructuredText("A Description")
asset.set_Structured_Description(description.to_obj())
assets.add_Affected_Asset(asset)
incident.set_Affected_Assets(assets)
s = StringIO()
incident.export(s, 0, {'http://stix.mitre.org/Incident-1': 'incident'})
xml = s.getvalue()
self.assertTrue("A Description" in xml, "Description not exported")
def from_dict(comment_dict):
if not comment_dict:
return None
comment_ = StructuredText.from_dict(comment_dict, Comment())
comment_.author = comment_dict.get("author")
comment_.timestamp = comment_dict.get("timestamp")
comment_.observation_name = comment_dict.get("observation_name")
return comment_
def from_obj(comment_obj):
if not comment_obj:
return None
comment_ = StructuredText.from_obj(comment_obj, Comment())
comment_.author = comment_obj.get_author()
comment_.timestamp = comment_obj.get_timestamp()
comment_.observation_name = comment_obj.get_observation_name()
return comment_
def test_description_output(self):
incident = incident_binding.IncidentType()
assets = incident_binding.AffectedAssetsType()
asset = incident_binding.AffectedAssetType()
description = StructuredText("A Description")
asset.Structured_Description = description.to_obj()
assets.add_Affected_Asset(asset)
incident.Affected_Assets = assets
s = StringIO.StringIO()
incident.export(s.write, 0, {'http://stix.mitre.org/Incident-1': 'incident'})
xml = s.getvalue()
self.assertTrue("A Description" in xml, "Description not exported")
def from_obj(observable_obj):
if not observable_obj:
return None
obs = Observable()
obs.id_ = observable_obj.get_id()
obs.title = observable_obj.get_Title()
obs.description = StructuredText.from_obj(observable_obj.get_Description())
obs.object_ = Object.from_obj(observable_obj.get_Object())
obs.observable_composition = ObservableComposition.from_obj(observable_obj.get_Observable_Composition())
obs.idref = observable_obj.get_idref()
return obs
def from_dict(observable_dict):
if not observable_dict:
return None
obs = Observable()
obs.id_ = observable_dict.get('id')
obs.title = observable_dict.get('title')
obs.description = StructuredText.from_dict(observable_dict.get('description'))
obs.object_ = Object.from_dict(observable_dict.get('object'))
obs.observable_composition = ObservableComposition.from_dict(observable_dict.get('observable_composition'))
obs.idref = observable_dict.get('idref')
return obs
def test_round_trip(self):
a = Address("*****@*****.**", Address.CAT_EMAIL)
a2 = Address("*****@*****.**", Address.CAT_EMAIL)
ms = MeasureSource()
ms.class_ = "System"
ms.source_type = "Analysis"
ms.description = StructuredText("A Description")
o = Observables([a, a2])
o.observable_package_source = ms
o2 = round_trip(o, output=True)
self.assertEqual(o.to_dict(), o2.to_dict())
def from_dict(measure_source_dict):
if not measure_source_dict:
return None
measure_source_ = MeasureSource()
measure_source_.class_ = measure_source_dict.get('class')
measure_source_.source_type = measure_source_dict.get('source_type')
measure_source_.name = measure_source_dict.get('name')
measure_source_.information_source_type = VocabString.from_dict(measure_source_dict.get('information_source_type'))
measure_source_.tool_type = VocabString.from_dict(measure_source_dict.get('tool_type'))
measure_source_.description = StructuredText.from_dict(measure_source_dict.get('description'))
measure_source_.contributors = Personnel.from_list(measure_source_dict.get('contributors'))
measure_source_.time = Time.from_dict(measure_source_dict.get('time'))
measure_source_.tools = ToolInformationList.from_list(measure_source_dict.get('tools'))
measure_source_.platform = None #TODO: add support
measure_source_.system = ObjectProperties.from_dict(measure_source_dict.get('system'))
measure_source_.instance = ObjectProperties.from_dict(measure_source_dict.get('instance'))
return measure_source_
def from_obj(measure_source_obj):
if not measure_source_obj:
return None
measure_source_ = MeasureSource()
measure_source_.class_ = measure_source_obj.get_class()
measure_source_.source_type = measure_source_obj.get_source_type()
measure_source_.name = measure_source_obj.get_name()
measure_source_.information_source_type = VocabString.from_obj(measure_source_obj.get_Information_Source_Type())
measure_source_.tool_type = VocabString.from_obj(measure_source_obj.get_Tool_Type())
measure_source_.description = StructuredText.from_obj(measure_source_obj.get_Description())
measure_source_.contributors = Personnel.from_obj(measure_source_obj.get_Contributors())
measure_source_.time = Time.from_obj(measure_source_obj.get_Time())
measure_source_.tools = ToolInformationList.from_obj(measure_source_obj.get_Tools())
measure_source_.platform = None #TODO: add support
measure_source_.system = ObjectProperties.from_obj(measure_source_obj.get_System())
measure_source_.instance = ObjectProperties.from_obj(measure_source_obj.get_Instance())
return measure_source_
def from_obj(observable_obj):
if not observable_obj:
return None
obs = Observable()
obs.id_ = observable_obj.get_id()
obs.title = observable_obj.get_Title()
obs.description = StructuredText.from_obj(observable_obj.get_Description())
obs.object_ = Object.from_obj(observable_obj.get_Object())
obs.event = Event.from_obj(observable_obj.get_Event())
obs.observable_composition = ObservableComposition.from_obj(observable_obj.get_Observable_Composition())
obs.idref = observable_obj.get_idref()
obs.sighting_count = observable_obj.get_sighting_count()
if observable_obj.get_Observable_Source():
obs.observable_source = [MeasureSource.from_obj(x) for x in observable_obj.get_Observable_Source()]
return obs
def _create_observables(self, msg):
o = Observables(self.__parse_email_message(msg))
t = ToolInformation()
t.name = os.path.basename(__file__)
t.description = StructuredText("Email to CybOX conversion script")
t.vendor = "The MITRE Corporation"
t.version = __version__
t_list = ToolInformationList()
t_list.append(t)
m = MeasureSource()
m.tools = t_list
o.observable_package_source = m
return o
def from_dict(observable_dict):
if not observable_dict:
return None
obs = Observable()
obs.id_ = observable_dict.get('id')
obs.title = observable_dict.get('title')
obs.description = StructuredText.from_dict(observable_dict.get('description'))
obs.object_ = Object.from_dict(observable_dict.get('object'))
obs.event = Object.from_dict(observable_dict.get('event'))
obs.observable_composition = ObservableComposition.from_dict(observable_dict.get('observable_composition'))
obs.idref = observable_dict.get('idref')
obs.sighting_count = observable_dict.get('sighting_count')
if observable_dict.get('observable_source'):
obs.observable_source = [MeasureSource.from_dict(x) for x in observable_dict.get('observable_source')]
return obs
def from_obj(toolinfo_obj, tool_class = None):
if not toolinfo_obj:
return None
if not tool_class:
toolinfo = ToolInformation()
else:
toolinfo = tool_class
toolinfo.id_ = toolinfo_obj.get_id()
toolinfo.idref = toolinfo_obj.get_idref()
toolinfo.name = toolinfo_obj.get_Name()
toolinfo.type_ = [ToolType.from_obj(x) for x in toolinfo_obj.get_Type()]
toolinfo.description = StructuredText.from_obj(toolinfo_obj.get_Description())
toolinfo.vendor = toolinfo_obj.get_Vendor()
toolinfo.version = toolinfo_obj.get_Version()
toolinfo.service_pack = toolinfo_obj.get_Service_Pack()
toolinfo.tool_hashes = HashList.from_obj(toolinfo_obj.get_Tool_Hashes())
return toolinfo
def from_obj(toolinfo_obj, toolinfo=None):
if not toolinfo_obj:
return None
if not toolinfo:
toolinfo = ToolInformation()
toolinfo.id_ = toolinfo_obj.id
toolinfo.idref = toolinfo_obj.idref
toolinfo.name = toolinfo_obj.Name
toolinfo.type_ = [VocabString.from_obj(x) for x in toolinfo_obj.Type]
toolinfo.description = StructuredText.from_obj(toolinfo_obj.Description)
toolinfo.vendor = toolinfo_obj.Vendor
toolinfo.version = toolinfo_obj.Version
toolinfo.service_pack = toolinfo_obj.Service_Pack
toolinfo.tool_hashes = HashList.from_obj(toolinfo_obj.Tool_Hashes)
return toolinfo
def from_dict(toolinfo_dict, toolinfo=None):
if not toolinfo_dict:
return None
if not toolinfo:
toolinfo = ToolInformation()
toolinfo.id_ = toolinfo_dict.get('id')
toolinfo.idref = toolinfo_dict.get('idref')
toolinfo.name = toolinfo_dict.get('name')
toolinfo.type_ = [VocabString.from_dict(x) for x in toolinfo_dict.get('type', [])]
toolinfo.description = StructuredText.from_dict(toolinfo_dict.get('description'))
toolinfo.vendor = toolinfo_dict.get('vendor')
toolinfo.version = toolinfo_dict.get('version')
toolinfo.service_pack = toolinfo_dict.get('service_pack')
toolinfo.tool_hashes = HashList.from_list(toolinfo_dict.get('tool_hashes'))
return toolinfo
def from_dict(observable_dict):
if not observable_dict:
return None
from cybox.core import PatternFidelity
obs = Observable()
obs.id_ = observable_dict.get('id')
obs.title = observable_dict.get('title')
obs.description = StructuredText.from_dict(observable_dict.get('description'))
obs.object_ = Object.from_dict(observable_dict.get('object'))
obs.event = Object.from_dict(observable_dict.get('event'))
obs.observable_composition = ObservableComposition.from_dict(observable_dict.get('observable_composition'))
obs.idref = observable_dict.get('idref')
obs.sighting_count = observable_dict.get('sighting_count')
if observable_dict.get('observable_source'):
obs.observable_source = [MeasureSource.from_dict(x) for x in observable_dict.get('observable_source')]
obs.keywords = Keywords.from_dict(observable_dict.get('keywords'))
obs.pattern_fidelity = PatternFidelity.from_dict(observable_dict.get('pattern_fidelity'))
return obs
def from_obj(toolinfo_obj, toolinfo=None):
if not toolinfo_obj:
return None
if not toolinfo:
toolinfo = ToolInformation()
toolinfo.id_ = toolinfo_obj.id
toolinfo.idref = toolinfo_obj.idref
toolinfo.name = toolinfo_obj.Name
toolinfo.type_ = [VocabString.from_obj(x) for x in toolinfo_obj.Type]
toolinfo.description = StructuredText.from_obj(
toolinfo_obj.Description)
toolinfo.vendor = toolinfo_obj.Vendor
toolinfo.version = toolinfo_obj.Version
toolinfo.service_pack = toolinfo_obj.Service_Pack
toolinfo.tool_hashes = HashList.from_obj(toolinfo_obj.Tool_Hashes)
return toolinfo
def from_obj(observable_obj):
if not observable_obj:
return None
from cybox.core import PatternFidelity
obs = Observable()
obs.id_ = observable_obj.id
obs.title = observable_obj.Title
obs.description = StructuredText.from_obj(observable_obj.Description)
obs.object_ = Object.from_obj(observable_obj.Object)
obs.event = Event.from_obj(observable_obj.Event)
obs.observable_composition = ObservableComposition.from_obj(observable_obj.Observable_Composition)
obs.idref = observable_obj.idref
obs.sighting_count = observable_obj.sighting_count
if observable_obj.Observable_Source:
obs.observable_source = [MeasureSource.from_obj(x) for x in observable_obj.Observable_Source]
obs.keywords = Keywords.from_obj(observable_obj.Keywords)
obs.pattern_fidelity = PatternFidelity.from_obj(observable_obj.Pattern_Fidelity)
return obs
def from_dict(action_dict, action_cls = None):
if not action_dict:
return None
if action_cls == None:
action_cls = Action()
action_ = action_cls
action_.id = action_dict.get('id')
action_.idref = action_dict.get('idref')
action_.ordinal_position = action_dict.get('ordinal_position')
action_.action_status = action_dict.get('action_status')
action_.context = action_dict.get('context')
action_.timestamp = action_dict.get('timestamp')
action_.type = VocabString.from_dict(action_dict.get('type'))
action_.name = VocabString.from_dict(action_dict.get('name'))
action_.description = StructuredText.from_dict(action_dict.get('description'))
action_.action_aliases = action_dict.get('action_aliases', [])
action_.action_arguments = ActionArguments.from_list(action_dict.get('action_arguments', []))
action_.discovery_method = MeasureSource.from_dict(action_dict.get('discovery_method'))
action_.associated_objects = AssociatedObjects.from_list(action_dict.get('associated_objects', []))
action_.relationships = ActionRelationships.from_list(action_dict.get('relationships', []))
#action_.frequency = Frequency.from_dict(action_dict.get('frequency')) #TODO: add support
return action_
def from_obj(action_obj, action_cls = None):
if not action_obj:
return None
if action_cls == None:
action_cls = Action()
action_ = action_cls
action_.id = action_obj.get_id()
action_.idref = action_obj.get_idref()
action_.ordinal_position = action_obj.get_ordinal_position()
action_.action_status = action_obj.get_action_status()
action_.context = action_obj.get_context()
action_.timestamp = action_obj.get_timestamp()
action_.type = VocabString.from_obj(action_obj.get_Type())
action_.name = VocabString.from_obj(action_obj.get_Name())
action_.description = StructuredText.from_obj(action_obj.get_Description())
if action_obj.get_Action_Arguments() is not None: action_.action_arguments = ActionArguments.from_obj(action_obj.get_Action_Arguments())
action_.discovery_method = MeasureSource.from_obj(action_obj.get_Discovery_Method())
if action_obj.get_Associated_Objects() is not None : action_.associated_objects = AssociatedObjects.from_obj(action_obj.get_Associated_Objects())
if action_obj.get_Relationships() is not None : action_.relationships = ActionRelationships.from_obj(action_obj.get_Relationships())
#action_.frequency = Frequency.from_dict(action_dict.get('frequency')) #TODO: add support
if action_obj.get_Action_Aliases() is not None :
action_.action_aliases = action_obj.get_Action_Aliases().get_Action_Alias()
return action_
def from_obj(toolinfo_obj, tool_class=None):
if not toolinfo_obj:
return None
if not tool_class:
toolinfo = ToolInformation()
else:
toolinfo = tool_class
toolinfo.id_ = toolinfo_obj.get_id()
toolinfo.idref = toolinfo_obj.get_idref()
toolinfo.name = toolinfo_obj.get_Name()
toolinfo.type_ = [
ToolType.from_obj(x) for x in toolinfo_obj.get_Type()
]
toolinfo.description = StructuredText.from_obj(
toolinfo_obj.get_Description())
toolinfo.vendor = toolinfo_obj.get_Vendor()
toolinfo.version = toolinfo_obj.get_Version()
toolinfo.service_pack = toolinfo_obj.get_Service_Pack()
toolinfo.tool_hashes = HashList.from_obj(
toolinfo_obj.get_Tool_Hashes())
return toolinfo
def description(self, value):
if value is not None and not isinstance(value, StructuredText):
value = StructuredText(value)
self._description = value
def make_cybox_object(type_, name=None, value=None):
"""
Converts type_, name, and value to a CybOX object instance.
:param type_: The object type.
:type type_: str
:param name: The object name.
:type name: str
:param value: The object value.
:type value: str
:returns: CybOX object
"""
if type_ == "Account":
acct = Account()
acct.description = value
return acct
elif type_ == "Address":
return Address(category=name, address_value=value)
elif type_ == "Email Message":
e = EmailMessage()
e.raw_body = value
return e
elif type_ == "API":
api = API()
api.description = value
return api
elif type_ == "Artifact":
if name == "Data Region":
atype = Artifact.TYPE_GENERIC
elif name == 'FileSystem Fragment':
atype = Artifact.TYPE_FILE_SYSTEM
elif name == 'Memory Region':
atype = Artifact.TYPE_MEMORY
else:
raise UnsupportedCybOXObjectTypeError(type_, name)
return Artifact(value, atype)
elif type_ == "Code":
obj = Code()
obj.code_segment = value
obj.type = name
return obj
elif type_ == "Disk":
disk = Disk()
disk.disk_name = type_
disk.type = name
return disk
elif type_ == "Disk Partition":
disk = DiskPartition()
disk.device_name = type_
disk.type = name
return disk
elif type_ == "DNS Query":
r = URI()
r.value = value
dq = DNSQuestion()
dq.qname = r
d = DNSQuery()
d.question = dq
return d
elif type_ == "DNS Record":
# DNS Record indicators in CRITs are just a free form text box, there
# is no good way to map them into the attributes of a DNSRecord cybox
# object. So just stuff it in the description until someone tells me
# otherwise.
d = StructuredText(value=value)
dr = DNSRecord()
dr.description = d
return dr
elif type_ == "GUI Dialogbox":
obj = GUIDialogbox()
obj.box_text = value
return obj
elif type_ == "GUI Window":
obj = GUIWindow()
obj.window_display_name = value
return obj
elif type_ == "HTTP Request Header Fields" and name and name == "User-Agent":
# TODO/NOTE: HTTPRequestHeaderFields has a ton of fields for info.
# we should revisit this as UI is reworked or CybOX is improved.
obj = HTTPRequestHeaderFields()
obj.user_agent = value
return obj
elif type_ == "Library":
obj = Library()
obj.name = value
obj.type = name
return obj
elif type_ == "Memory":
obj = Memory()
obj.memory_source = value
return obj
elif type_ == "Mutex":
m = Mutex()
m.named = True
m.name = String(value)
return m
elif type_ == "Network Connection":
obj = NetworkConnection()
obj.layer7_protocol = value
return obj
elif type_ == "Pipe":
p = Pipe()
p.named = True
p.name = String(value)
return p
elif type_ == "Port":
p = Port()
try:
p.port_value = PositiveInteger(value)
except ValueError: # XXX: Raise a better exception...
raise UnsupportedCybOXObjectTypeError(type_, name)
return p
elif type_ == "Process":
p = Process()
p.name = String(value)
return p
elif type_ == "String":
c = Custom()
c.custom_name = "crits:String"
c.description = ("This is a generic string used as the value of an "
"Indicator or Object within CRITs.")
c.custom_properties = CustomProperties()
p1 = Property()
p1.name = "value"
p1.description = "Generic String"
p1.value = value
c.custom_properties.append(p1)
return c
elif type_ == "System":
s = System()
s.hostname = String(value)
return s
elif type_ == "URI":
r = URI()
r.type_ = name
r.value = value
return r
elif type_ == "User Account":
obj = UserAccount()
obj.username = value
return obj
elif type_ == "Volume":
obj = Volume()
obj.name = value
return obj
elif type_ == "Win Driver":
w = WinDriver()
w.driver_name = String(value)
return w
elif type_ == "Win Event Log":
obj = WinEventLog()
obj.log = value
return obj
elif type_ == "Win Event":
w = WinEvent()
w.name = String(value)
return w
elif type_ == "Win Handle":
obj = WinHandle()
obj.type_ = name
obj.object_address = value
return obj
elif type_ == "Win Kernel Hook":
obj = WinKernelHook()
obj.description = value
return obj
elif type_ == "Win Mailslot":
obj = WinMailslot()
obj.name = value
return obj
elif type_ == "Win Network Share":
obj = WinNetworkShare()
obj.local_path = value
return obj
elif type_ == "Win Process":
obj = WinProcess()
obj.window_title = value
return obj
elif type_ == "Win Registry Key":
obj = WinRegistryKey()
obj.key = value
return obj
elif type_ == "Win Service":
obj = WinService()
obj.service_name = value
return obj
elif type_ == "Win System":
obj = WinSystem()
obj.product_name = value
return obj
elif type_ == "Win Task":
obj = WinTask()
obj.name = value
return obj
elif type_ == "Win User Account":
obj = WinUser()
obj.security_id = value
return obj
elif type_ == "Win Volume":
obj = WinVolume()
obj.drive_letter = value
return obj
elif type_ == "X509 Certificate":
obj = X509Certificate()
obj.raw_certificate = value
return obj
"""
The following are types that are listed in the 'Indicator Type' box of
the 'New Indicator' dialog in CRITs. These types, unlike those handled
above, cannot be written to or read from CybOX at this point.
The reason for the type being omitted is written as a comment inline.
This can (and should) be revisited as new versions of CybOX are released.
NOTE: You will have to update the corresponding make_crits_object function
with handling for the reverse direction.
In the mean time, these types will raise unsupported errors.
"""
#elif type_ == "Device": # No CybOX API
#elif type_ == "DNS Cache": # No CybOX API
#elif type_ == "GUI": # revisit when CRITs supports width & height specification
#elif type_ == "HTTP Session": # No good mapping between CybOX/CRITs
#elif type_ == "Linux Package": # No CybOX API
#elif type_ == "Network Packet": # No good mapping between CybOX/CRITs
#elif type_ == "Network Route Entry": # No CybOX API
#elif type_ == "Network Route": # No CybOX API
#elif type_ == "Network Subnet": # No CybOX API
#elif type_ == "Semaphore": # No CybOX API
#elif type_ == "Socket": # No good mapping between CybOX/CRITs
#elif type_ == "UNIX File": # No CybOX API
#elif type_ == "UNIX Network Route Entry": # No CybOX API
#elif type_ == "UNIX Pipe": # No CybOX API
#elif type_ == "UNIX Process": # No CybOX API
#elif type_ == "UNIX User Account": # No CybOX API
#elif type_ == "UNIX Volume": # No CybOX API
#elif type_ == "User Session": # No CybOX API
#elif type_ == "Whois": # No good mapping between CybOX/CRITs
#elif type_ == "Win Computer Account": # No CybOX API
#elif type_ == "Win Critical Section": # No CybOX API
#elif type_ == "Win Executable File": # No good mapping between CybOX/CRITs
#elif type_ == "Win File": # No good mapping between CybOX/CRITs
#elif type_ == "Win Kernel": # No CybOX API
#elif type_ == "Win Mutex": # No good mapping between CybOX/CRITs
#elif type_ == "Win Network Route Entry": # No CybOX API
#elif type_ == "Win Pipe": # No good mapping between CybOX/CRITs
#elif type_ == "Win Prefetch": # No CybOX API
#elif type_ == "Win Semaphore": # No CybOX API
#elif type_ == "Win System Restore": # No CybOX API
#elif type_ == "Win Thread": # No good mapping between CybOX/CRITs
#elif type_ == "Win Waitable Timer": # No CybOX API
raise UnsupportedCybOXObjectTypeError(type_, name)
