def get_indicator_from_json(indicator_json, user_timezone): type_ = indicator_json['type'] v = indicator_json['value'] title = indicator_json['title'] o_ = None # ipv4か? if type_ == JSON_OBJECT_TYPE_IPV4: o_ = Address() o_.address_value = v.replace('[', '').replace(']', '') # urlか? if type_ == JSON_OBJECT_TYPE_URI: o_ = URI() o_.value = v # md5か? if type_ == JSON_OBJECT_TYPE_MD5: o_ = File() o_.md5 = v # sha1か? if type_ == JSON_OBJECT_TYPE_SHA1: o_ = File() o_.sha1 = v # sha256か? if type_ == JSON_OBJECT_TYPE_SHA256: o_ = File() o_.sha256 = v # sha512か? if type_ == JSON_OBJECT_TYPE_SHA512: o_ = File() o_.sha512 = v # email-addressか? if type_ == JSON_OBJECT_TYPE_EMAIL_ADDRESS: o_ = EmailAddress() o_.address_value = v # domainか? if type_ == JSON_OBJECT_TYPE_DOMAIN: o_ = DomainName() o_.value = v.replace('[', '').replace(']', '') # file名か? if type_ == JSON_OBJECT_TYPE_FILE_NAME: o_ = File() o_.file_name = v # なにも該当していないので None if o_ is None: print('何も該当なし:' + str(type_) + ':' + str(v)) return None # indicator 作って返却 indicator_title = '%s (%s)' % (v, title) ind = CommonExtractor.get_indicator_from_object( o_, indicator_title, user_timezone) return ind