a simple flash app that

• collect FireEye (CMS) produced Extended XML notification
• dispatches to fexml2stix.FireEyeXMLParser (STIX)
• collects the malware object from FireEye Alerts
• send malware objects to a Viper instance for storage

Parses the XML, uses fireeye.* API, translates to STIX, and send to STIX server.

a WS API and HTML API to collect additional alerts/reports from the CMS.

XML to Python bindings by generateDS. FireEye (~7.6) alerts XSD to python.

Wrapper to push malware file object to a viper instance

Set the variables in the config.py file

1. Create HTTP Event
2. Add HTTP Server
3. Name it 'fexml2stix'
4. Set the server URL as 'http://youserver.com:5000/api/v1/fe'
5. Notify for all events and deliver per event
6. Leave it as the generic provider
7. Select 'JSON Normal' for the message format
8. Submit a malicious sample, and watch the magic happen