Python Observable.short_description方法代码示例

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
def create_url_observable(url):
    url_object = URI.from_dict({"value": url, "type": URI.TYPE_URL})
    url_observable = Observable(url_object)
    url_observable.title = "Malware Artifact - URL"
    url_observable.description = "URL derived from sandboxed malware sample."
    url_observable.short_description = "URL from malware."
    return url_observable

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
def create_domain_name_observable(domain_name):
    domain_name_object = URI.from_dict({"value": domain_name, "type": URI.TYPE_DOMAIN})
    domain_name_observable = Observable(domain_name_object)
    domain_name_observable.title = "Malware Artifact - Domain"
    domain_name_observable.description = "Domain derived from sandboxed malware sample."
    domain_name_observable.short_description = "Domain from malware."
    return domain_name_observable

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
def create_ipv4_observable(ipv4_address):
    ipv4_object = Address.from_dict({"address_value": ipv4_address, "category": Address.CAT_IPV4})
    ipv4_observable = Observable(ipv4_object)
    ipv4_observable.title = "Malware Artifact - IP"
    ipv4_observable.description = "IP derived from sandboxed malware sample."
    ipv4_observable.short_description = "IP from malware."
    return ipv4_observable

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_url_observable(self, url):
     if url in self.__urls:
         return
     self.__urls.add(url)
     url_object = URI.from_dict({'value': url, 'type': URI.TYPE_URL})
     url_observable = Observable(url_object)
     url_observable.title = "Malware Artifact - URL"
     url_observable.description = "URL derived from sandboxed malware sample."
     url_observable.short_description = "URL from malware."
     self.url_indicator.add_observable(url_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_domain_name_observable(self, domain_name):
     if domain_name in self.__domains:
         return
     self.__domains.add(domain_name)
     domain_name_object = URI.from_dict({'value': domain_name, 'type': URI.TYPE_DOMAIN})
     domain_name_observable = Observable(domain_name_object)
     domain_name_observable.title = "Malware Artifact - Domain"
     domain_name_observable.description = "Domain derived from sandboxed malware sample."
     domain_name_observable.short_description = "Domain from malware."
     self.domain_indicator.add_observable(domain_name_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_ipv4_observable(self, ipv4_address):
     if ipv4_address in self.__ipv4:
         return
     self.__ipv4.add(ipv4_address)
     ipv4_object = Address.from_dict({'address_value': ipv4_address, 'category': Address.CAT_IPV4})
     ipv4_observable = Observable(ipv4_object)
     ipv4_observable.title = "Malware Artifact - IP"
     ipv4_observable.description = "IP derived from sandboxed malware sample."
     ipv4_observable.short_description = "IP from malware."
     self.ip_indicator.add_observable(ipv4_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
def create_file_hash_observable(filename, hash_value):
    hash_ = Hash(hash_value)
    file_ = File()
    file_.file_name = filename
    file_.add_hash(hash_)
    file_observable = Observable(file_)
    file_observable.title = "Malware Artifact - File Hash"
    file_observable.description = "File hash derived from sandboxed malware sample."
    file_observable.short_description = "File hash from malware."
    return file_observable

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_registry_observable(self, mode, value):
     if (mode, value) in self.__regkeys:
         return
     self.__regkeys.add((mode, value))
     # FIXME value is not parse properly
     _key = '\\'.join(value.split('\\')[3:])
     hive = value.split('\\')[2]
     reg_object = WinRegistryKey.from_dict({'key': _key, 'hive': hive})
     reg_observable = Observable(reg_object)
     reg_observable.title = "Malware Artifact - Registry"
     reg_observable.description = "Registry access derived from sandboxed malware sample."
     reg_observable.short_description = "Registry access from malware."
     self.reg_indicator.add_observable(reg_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_file_hash_observable(self, filename, md5_value, sha1_value):
     if (filename, md5_value, sha1_value) in self.__hashes:
         return
     self.__hashes.add((filename, md5_value, sha1_value))
     file_ = File()
     file_.file_name = filename
     file_.add_hash(Hash(md5_value))
     file_.add_hash(Hash(sha1_value))
     file_observable = Observable(file_)
     file_observable.title = "Malware Artifact - File Hash"
     file_observable.description = "File hash derived from sandboxed malware sample."
     file_observable.short_description = "File hash from malware."
     self.hash_indicator.add_observable(file_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def add_file_dropped_observable(self, filename):
     if filename in self.__files:
         return
     self.__files.add(filename)
     #hash_ = Hash(hash_value)
     file_ = File()
     file_.file_name = filename
     #file_.add_hash(hash_)
     file_observable = Observable(file_)
     file_observable.title = "Malware Artifact - File Dropped"
     file_observable.description = "File Dropped derived from sandboxed malware sample."
     file_observable.short_description = "File Dropped from malware."
     self.hash_indicator.add_observable(file_observable)

# 需要导入模块: from cybox.core import Observable [as 别名]
# 或者: from cybox.core.Observable import short_description [as 别名]
 def __add_dns_query_observable(self, qname, qtype, qclass):
     dns_query_object = DNSQuery.from_dict({'value': dns_query, 'type': URI.TYPE_DOMAIN})
     dns_query_observable = Observable(dns_query_object)
     dns_query_observable.title = "Malware Artifact - DNS query"
     dns_query_observable.description = "DNS query derived from sandboxed malware sample."
     dns_query_observable.short_description = "DNS query from malware."