def get_last_sync(self, src, dest, direction=None,): doc = self.collection.find_one({'src': src, 'dest': dest, 'direction': direction}) if doc and 'timestamp' in doc.keys(): return(doc['timestamp'].replace(tzinfo=pytz.utc)) else: return(util_.epoch_start().replace(tzinfo=pytz.utc))
def taxii_poll(config, src, dest, timestamp=None): '''pull stix from edge via taxii''' client = tc.HttpClient() client.setUseHttps(config['edge']['sites'][src]['taxii']['ssl']) client.setAuthType(client.AUTH_BASIC) client.setAuthCredentials( {'username': config['edge']['sites'][src]['taxii']['user'], 'password': config['edge']['sites'][src]['taxii']['pass']}) if not timestamp: earliest = util_.epoch_start() else: earliest = timestamp latest = util_.nowutc() poll_request = tm10.PollRequest( message_id=tm10.generate_message_id(), feed_name=config['edge']['sites'][src]['taxii']['collection'], exclusive_begin_timestamp_label=earliest, inclusive_end_timestamp_label=latest, content_bindings=[t.CB_STIX_XML_11]) http_response = client.callTaxiiService2( config['edge']['sites'][src]['host'], config['edge']['sites'][src]['taxii']['path'], t.VID_TAXII_XML_10, poll_request.to_xml(), port=config['edge']['sites'][src]['taxii']['port']) taxii_message = t.get_message_from_http_response(http_response, poll_request.message_id) if isinstance(taxii_message, tm10.StatusMessage): config['logger'].error(log_.log_messages['polling_error'].format( type_='taxii', error=taxii_message.message)) elif isinstance(taxii_message, tm10.PollResponse): incidents = dict() indicators = dict() observables = dict() for content_block in taxii_message.content_blocks: (incidents_, indicators_, observables_) = \ process_taxii_content_blocks(config, content_block) incidents.update(incidents_) indicators.update(indicators_) observables.update(observables_) return(latest, incidents, indicators, observables)