Python Address.category方法代码示例

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
    def to_cybox_observable(self):
        """
            Convert an IP to a CybOX Observables.
            Returns a tuple of (CybOX object, releasability list).

            To get the cybox object as xml or json, call to_xml() or
            to_json(), respectively, on the resulting CybOX object.
        """
        obj = Address()
        obj.address_value = self.ip

        temp_type = self.ip_type.replace("-", "")
        if temp_type.find(Address.CAT_ASN.replace("-", "")) >= 0:
            obj.category = Address.CAT_ASN
        elif temp_type.find(Address.CAT_ATM.replace("-", "")) >= 0:
            obj.category = Address.CAT_ATM
        elif temp_type.find(Address.CAT_CIDR.replace("-", "")) >= 0:
            obj.category = Address.CAT_CIDR
        elif temp_type.find(Address.CAT_MAC.replace("-", "")) >= 0:
            obj.category = Address.CAT_MAC
        elif temp_type.find(Address.CAT_IPV4_NETMASK.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV4_NETMASK
        elif temp_type.find(Address.CAT_IPV4_NET.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV4_NET
        elif temp_type.find(Address.CAT_IPV4.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV4
        elif temp_type.find(Address.CAT_IPV6_NETMASK.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV6_NETMASK
        elif temp_type.find(Address.CAT_IPV6_NET.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV6_NET
        elif temp_type.find(Address.CAT_IPV6.replace("-", "")) >= 0:
            obj.category = Address.CAT_IPV6

        return ([Observable(obj)], self.releasability)

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
def generateIPObservable(attribute):
    address_object = Address()
    cidr = False
    if ("/" in attribute["value"]):
        ip = attribute["value"].split('/')[0]
        cidr = True
    else:
        ip = attribute["value"]
    try:
        socket.inet_aton(ip)
        ipv4 = True
    except socket.error:
        ipv4 = False
    if (cidr == True):
        address_object.category = "cidr"
    elif (ipv4 == True):
        address_object.category = "ipv4-addr"
    else:
        address_object.category = "ipv6-addr"
    if (attribute["type"] == "ip-src"):
        address_object.is_source = True
    else:
        address_object.is_source = False
    address_object.address_value = attribute["value"]
    return address_object

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
    def test_round_trip(self):
        v = String("[email protected]")
        c = Address.CAT_EMAIL

        a = Address()
        a.address_value = v
        a.category = c

        addr2 = round_trip(a, Address, output=False)

        self.assertEqual(addr2.address_value, v)
        self.assertEqual(addr2.category, c)

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
    def test_istypeof(self):
        a = "[email protected]"

        addr1 = EmailAddress(a)
        self.assertTrue(Address.istypeof(addr1))
        self.assertTrue(EmailAddress.istypeof(addr1))

        # Address with no category set
        addr2 = Address(a)
        self.assertTrue(Address.istypeof(addr2))
        self.assertFalse(EmailAddress.istypeof(addr2))

        # Even though the isinstance check fails, the istypeof check should
        # succeed
        addr2.category = Address.CAT_EMAIL
        self.assertTrue(Address.istypeof(addr2))
        self.assertTrue(EmailAddress.istypeof(addr2))
        self.assertFalse(isinstance(addr2, EmailAddress))

        # Address with category set to something other than CAT_EMAIL
        addr2.category = Address.CAT_IPV4
        self.assertTrue(Address.istypeof(addr2))
        self.assertFalse(EmailAddress.istypeof(addr2))

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
    def test_round_trip(self):
        email = "[email protected]"
        category = Address.CAT_EMAIL

        addr = Address()
        addr.address_value = email
        addr.category = category

        addr2 = cybox.test.round_trip(addr)

        self.assertEqual(addr.to_dict(), addr2.to_dict())

        # Explicitly check these fields
        self.assertEqual(category, addr2.category)
        self.assertEqual(email, str(addr2))

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
def create_stix_package(reference,results):
    stix_package = STIXPackage()

    STIX_NAMESPACE = {"http://wapacklabs.com" : "wapack"}

    OBS_NAMESPACE = Namespace("http://wapacklabs.com", "wapack")

    stix_set_id_namespace(STIX_NAMESPACE)

    obs_set_id_namespace(OBS_NAMESPACE)
    
    stix_header = STIXHeader()

    fusionreport_title = reference
    timestring = time.time()
    formatted_timestring = datetime.fromtimestamp(timestring).strftime('%Y_%m_%d')
    stix_file_name = fusionreport_title+'_stix_package_TR_'+formatted_timestring+'.xml'


    
    stix_header.description = 'This STIX package includes indicators reported to the Red Sky community. Please send all inquiries to [email protected]'
    stix_package.stix_header = stix_header
    for item in results:
        process_type = str(item["ProcessType"]).decode('utf-8')
        if process_type == 'Direct':
            indicator = str(item["Indicator"]).decode('utf-8')
            #print indicator
            item_reference = str(item["Reference"]).decode('utf-8')
            source = str(item["Source"]).decode('utf-8')
            killchain = str(item["KillChain"]).decode('utf-8')
            first_seen = str(item["FirstSeen"]).decode('utf-8')
            last_seen = str(item["LastSeen"]).decode('utf-8')
            attribution = str(item["Attribution"]).decode('utf-8')
            indicator_type = str(item["Type"]).decode('utf-8')               
            rrname = str(item["Rrname"])
            rdata = str(item["Rdata"])
            rootnode = str(item["RootNode"])
            country = str(item["Country"]).decode('utf-8')
            tags = str(item["Tags"]).decode('utf-8')
            comment2 = item["Comment"]
            comment = unicodedata.normalize('NFKD', comment2).encode('ascii','ignore')
            confidence = str(item["Confidence"]).decode('utf-8')

            if indicator_type == 'MD5' or indicator_type == 'SHA1':
                f = File()
                hashval = indicator
                hashval2 = hashval.decode('utf8', 'ignore')
                f.add_hash(hashval2)
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,f,stix_package)
            if indicator_type == 'Registry':
                reg = WinRegistryKey()
                key = indicator
                key_add = key.decode('utf8', 'ignore')
                reg.key = key_add
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,reg,stix_package)
            if indicator_type == 'Subject':
                email_subj_obj = EmailMessage()
                email_subj_obj.header = EmailHeader()
                subj = indicator
                subj_add = subj.decode('utf8', 'ignore')
                email_subj_obj.header.subject = subj_add
                indcator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,email_subj_obj,stix_package) 
            if indicator_type == 'File':
                filename = File()
                file_name_fix = indicator
                file_name_fix2 = file_name_fix.decode('utf8', 'ignore')
                filename.file_name = file_name_fix2
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,filename,stix_package)
            if indicator_type == 'Email':
                email = Address()
                email.address_value = indicator.decode('utf8', 'ignore')
                email.category = Address.CAT_EMAIL
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,email,stix_package)
            if indicator_type == 'Domain':
                domain = URI()
                domainval = indicator.decode('utf8', 'ignore')
                domain.value = domainval.decode('utf8', 'ignore')
                domain.type_ = URI.TYPE_DOMAIN
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,domain,stix_package)
            if indicator_type == 'IP':
                ip = Address()
                ip.address_value = indicator.decode('utf8', 'ignore')
                ip.category = Address.CAT_IPV4
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,ip,stix_package)
            if indicator_type == 'String':
                strng = Memory()
                string = indicator
                strng.name = string.decode('utf8', 'ignore')
                indicator = Indicator()
                add_stix_indicator_regular(indicator,indicator,item_reference,tags,source,last_seen,confidence,process_type,comment,killchain,attribution,strng,stix_package)
            if indicator_type == 'URL':
                url = URI()
                url_indicator = indicator
#.........这里部分代码省略.........

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]

#.........这里部分代码省略.........
	ttp_plugX = TTP(title="PlugX Dropper")
	ttp_plugX.behavior = Behavior()
	ttp_plugX.behavior.add_malware_instance(plugXObj)
	ttp_plugX.add_intended_effect("Theft - Intellectual Property")
	plugX_hashInd = Indicator(title="File hashes for PlugX Dropper")
	plugX_hashInd.add_indicator_type("File Hash Watchlist")
	plugX_hashInd.confidence = "High"
	plugX_hashInd.add_indicated_ttp(TTP(idref=ttp_plugX.id_))

        #=============
        # Process content in to structure
        #=============
	ip_rules = []
	ip_rules_M = []
	domain_rules = []
	with open(inFile, 'rb') as f:
                reader = csv.reader(f)
		for row in reader:
                        obs = row[0]
                        obsType = row[1]
                        description = row[2]
                        confidence = row[3]
			#print obs,obsType,description,confidence
			if description == 'TG-3390 infrastructure':
				if obsType == 'Domain name':
					domain_obj = DomainName()
        	                        domain_obj.value = obs
					#domain_obj.title = description
	                                infra_domainInd.add_object(domain_obj)
					domain_rule = generate_snort([obs], 'DomainName', str(infra_domainInd.id_).split(':',1)[1].split('-',1)[1])
					domain_rules.append(domain_rule)
				elif obsType == 'IP address':
					ipv4_obj = Address()
                	                ipv4_obj.category = "ipv4-addr"
        	                        ipv4_obj.address_value = obs
					ipv4_obj.title = description
					ind_ref = str(infra_IPInd.id_).split(':',1)[1].split('-',1)[1]
					if confidence == "High":
	                                	infra_IPInd.add_object(ipv4_obj)
						ip_rules.append(obs)
					else:
						infra_IPInd_M.add_object(ipv4_obj)
						ip_rules_M.append(obs)
				else:
					print "TTP Infra: obsType is wrong"
			elif description == 'HttpBrowser RAT dropper':
				file_obj = File()
				file_obj.add_hash(Hash(obs))
				file_obj.title = description
				httpBDpr_hashInd.add_observable(file_obj)
			elif description == 'HttpBrowser RAT':
				file_obj = File()
                                file_obj.add_hash(Hash(obs))
				file_obj.title = description
                                httpB_hashInd.add_observable(file_obj)
			elif description == 'PlugX RAT dropper':
				file_obj = File()
                                file_obj.add_hash(Hash(obs))
				file_obj.title = description
                                plugX_hashInd.add_observable(file_obj)
			else:
				print "TTP not found"
	#print ip_rules
	ip_rule = generate_snort(ip_rules, 'Address', str(infra_IPInd.id_).split(':',1)[1].split('-',1)[1])
	ip_rule_M = generate_snort(ip_rules_M, 'Address', str(infra_IPInd_M.id_).split(':',1)[1].split('-',1)[1])

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
    doc = xmltodict.parse(res.read())

    # Create the STIX Package
    package = STIXPackage()

    # Create the STIX Header and add a description.
    header = STIXHeader()
    #header.title = "SANS ISC Top-100 Malicious IP Addresses"
    #header.description = "Source: " + url
    package.stix_header = header

    for entry in doc['topips']['ipaddress']:
        bytes = entry['source'].split('.')

        indicator = Indicator()
        indicator.title = "SANS ISC Malicious IP"
        indicator.add_indicator_type("IP Watchlist")

        ip = Address()
        ip.address_value = "%d.%d.%d.%d" % (int(bytes[0]), int(bytes[1]), int(bytes[2]) , int(bytes[3]))
        ip.category = 'ipv4-addr'
        ip.condition = 'Equals'
        indicator.add_observable(ip)

        package.add_indicator(indicator)

    print(package.to_xml())

if __name__ == '__main__':
    main()

# 需要导入模块: from cybox.objects.address_object import Address [as 别名]
# 或者: from cybox.objects.address_object.Address import category [as 别名]
def cybox_object_address(obj):
    a = Address()
    a.address_value =obj.address_value
    a.category = obj.category
    a.condition = obj.condition
    return a