def _translate_fields(cls, node):
"""The TTP:Exploit_Targets field became a GenericRelationshipListType
in STIX 1.1.
<ttp:Exploit_Targets>
<stixCommon:Exploit_Target idref='example:et-1'/>
<stixCommon:Exploit_Target idref='example:et-2'/>
</ttp:Exploit_Targets>
Becomes...
<ttp:Exploit_Targets>
<ttp:Exploit_Target>
<stixCommon:Exploit_Target idref='example:et-1'/>
</ttp:Exploit_Target>
<ttp:Exploit_Target>
<stixCommon:Exploit_Target idref='example:et-2'/>
</ttp:Exploit_Target>
</ttp:Exploit_Targets>
Args:
node: The outer ttp:Exploit_Targets node.
"""
tag = "{http://stix.mitre.org/TTP-1}Exploit_Target"
dup = utils.copy_xml_element(node)
wrapper = etree.Element(tag)
wrapper.append(dup)
return wrapper
def _translate_fields(cls, node):
"""This updates instances of stixCommon:ContributorsType to instances
of stixCommon:ContributingSourcesType.
The STIX v1.0.1 ContributorsType contains a list of `Contributor`
elements under it which were IdentityType instances.
The STIX v1.1 ContributingSourcesType contains a list of `Source`
elements under it which are instances of InformationSourceType.
Because InformationSourceType has an `Identity` child element which is
an instance of `IdentityType`, we can perform the following
transformation:
<stix:Information_Source>
<stixCommon:Contributors>
<stixCommon:Contributor>
<stixCommon:Name>Example</stixCommon:Name>
</stixCommon:Contributor>
<stixCommon:Contributor>
<stixCommon:Name>Another</stixCommon:Name>
</stixCommon:Contributor>
</stixCommon:Contributors>
</stix:Information_Source>
Becomes...
<stix:Information_Source>
<stixCommon:Contributing_Sources>
<stixCommon:Source>
<stixCommon:Identity>
<stixCommon:Name>Example</stixCommon:Name>
</stixCommon:Identity>
</stixCommon:Source>
<stixCommon:Source>
<stixCommon:Identity>
<stixCommon:Name>Another</stixCommon:Name>
</stixCommon:Identity>
</stixCommon:Source>
</stixCommon:Contributing_Sources>
</stix:Information_Source>
Args:
node: A ``stixCommon:Contributors`` node
"""
ns_common = "http://stix.mitre.org/common-1"
contributing_sources_tag = "{%s}Contributing_Sources" % ns_common
source_tag = "{%s}Source" % ns_common
identity_tag = "{%s}Identity" % ns_common
contributing_sources = etree.Element(contributing_sources_tag)
for contributor in node:
dup = utils.copy_xml_element(contributor, tag=identity_tag)
source = etree.Element(source_tag)
source.append(dup)
contributing_sources.append(source)
return contributing_sources
def _translate_fields(cls, node):
"""This updates instances of stixCommon:ContributorsType to instances
of stixCommon:ContributingSourcesType.
The STIX v1.0.1 ContributorsType contains a list of `Contributor`
elements under it which were IdentityType instances.
The STIX v1.1 ContributingSourcesType contains a list of `Source`
elements under it which are instances of InformationSourceType.
Because InformationSourceType has an `Identity` child element which is
an instance of `IdentityType`, we can perform the following
transformation:
<stix:Information_Source>
<stixCommon:Contributors>
<stixCommon:Contributor>
<stixCommon:Name>Example</stixCommon:Name>
</stixCommon:Contributor>
<stixCommon:Contributor>
<stixCommon:Name>Another</stixCommon:Name>
</stixCommon:Contributor>
</stixCommon:Contributors>
</stix:Information_Source>
Becomes...
<stix:Information_Source>
<stixCommon:Contributing_Sources>
<stixCommon:Source>
<stixCommon:Identity>
<stixCommon:Name>Example</stixCommon:Name>
</stixCommon:Identity>
</stixCommon:Source>
<stixCommon:Source>
<stixCommon:Identity>
<stixCommon:Name>Another</stixCommon:Name>
</stixCommon:Identity>
</stixCommon:Source>
</stixCommon:Contributing_Sources>
</stix:Information_Source>
Args:
node: A ``stixCommon:Contributors`` node
"""
ns_common = "http://stix.mitre.org/common-1"
contributing_sources_tag = "{%s}Contributing_Sources" % ns_common
source_tag = "{%s}Source" % ns_common
identity_tag = "{%s}Identity" % ns_common
contributing_sources = etree.Element(contributing_sources_tag)
for contributor in node:
dup = utils.copy_xml_element(contributor, tag=identity_tag)
source = etree.Element(source_tag)
source.append(dup)
contributing_sources.append(source)
return contributing_sources
def _translate_fields(cls, node):
"""Translates Indicator Related_Campaigns/Related_Campaign instances
to STIX v1.1.1.
<indicator:Related_Campaigns>
<indicator:Related_Campaign>
<stixCommon:Names>
<stixCommon:Name>Foo</stixCommon:Name>
</stixCommon:Names>
</indicator:Related_Campaign>
<indicator:Related_Campaign idref='campaign-foo-1'/>
</indicator:Related_Campaigns>
Becomes
<indicator:Related_Campaigns>
<indicator:Related_Campaign>
<stixCommon:Campaign>
<stixCommon:Names>
<stixCommon:Name>Foo</stixCommon:Name>
</stixCommon:Names>
</stixCommon:Campaign>
</indicator:Related_Campaign>
<indicator:Related_Campaign>
<stixCommon:Campaign idref="campaign-foo-1>
</indicator:Related_Campaign>
</indicator:Related_Campaigns>
"""
dup = utils.copy_xml_element(node, tag=cls.NEW_TAG)
wrapper = etree.Element(
"{http://stix.mitre.org/Indicator-2}Related_Campaign"
)
wrapper.append(dup)
return wrapper
def _translate_fields(cls, node):
"""The TTP:Exploit_Targets field became a GenericRelationshipListType
in STIX 1.1.
<ttp:Exploit_Targets>
<stixCommon:Exploit_Target idref='example:et-1'/>
<stixCommon:Exploit_Target idref='example:et-2'/>
</ttp:Exploit_Targets>
Becomes...
<ttp:Exploit_Targets>
<ttp:Exploit_Target>
<stixCommon:Exploit_Target idref='example:et-1'/>
</ttp:Exploit_Target>
<ttp:Exploit_Target>
<stixCommon:Exploit_Target idref='example:et-2'/>
</ttp:Exploit_Target>
</ttp:Exploit_Targets>
Args:
node: The outer ttp:Exploit_Targets node.
"""
tag = "{http://stix.mitre.org/TTP-1}Exploit_Target"
dup = utils.copy_xml_element(node)
wrapper = etree.Element(tag)
wrapper.append(dup)
return wrapper
def _translate_fields(cls, node):
"""Translates Indicator Related_Campaigns/Related_Campaign instances
to STIX v1.1.1.
<indicator:Related_Campaigns>
<indicator:Related_Campaign>
<stixCommon:Names>
<stixCommon:Name>Foo</stixCommon:Name>
</stixCommon:Names>
</indicator:Related_Campaign>
<indicator:Related_Campaign idref='campaign-foo-1'/>
</indicator:Related_Campaigns>
Becomes
<indicator:Related_Campaigns>
<indicator:Related_Campaign>
<stixCommon:Campaign>
<stixCommon:Names>
<stixCommon:Name>Foo</stixCommon:Name>
</stixCommon:Names>
</stixCommon:Campaign>
</indicator:Related_Campaign>
<indicator:Related_Campaign>
<stixCommon:Campaign idref="campaign-foo-1>
</indicator:Related_Campaign>
</indicator:Related_Campaigns>
"""
dup = utils.copy_xml_element(node, tag=cls.NEW_TAG)
wrapper = etree.Element(
"{http://stix.mitre.org/Indicator-2}Related_Campaign")
wrapper.append(dup)
return wrapper
def _clean_disallowed(self, disallowed, options):
"""Removes the `disallowed` nodes from the source document.
Args:
disallowed: A list of nodes to remove from the source document.
Returns:
A list of `disallowed` node copies.
"""
removed = []
for node in disallowed:
dup = utils.copy_xml_element(node)
utils.remove_xml_element(node)
removed.append(dup)
return removed
def _clean_disallowed(self, disallowed, options):
"""Removes the `disallowed` nodes from the source document.
Args:
disallowed: A list of nodes to remove from the source document.
Returns:
A list of `disallowed` node copies.
"""
removed = []
for node in disallowed:
dup = utils.copy_xml_element(node)
utils.remove_xml_element(node)
removed.append(dup)
return removed
def _replace(cls, node):
parent = node.getparent()
dup = utils.copy_xml_element(node, tag=cls.NEW_TAG)
utils.replace_xml_element(parent, dup)
def _replace(cls, node):
parent = node.getparent()
dup = utils.copy_xml_element(node, tag=cls.NEW_TAG)
utils.replace_xml_element(parent, dup)
