Python STIXPackage.add方法代码示例

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def url(ip,provider,reporttime):
    vuln = Vulnerability()
    vuln.cve_id = "IPV4-" + str(ip)
    vuln.description = "maliciousURL"
    et = ExploitTarget(title=provider + " observable")
    et.add_vulnerability(vuln)
    
    addr = Address(address_value=str(ip), category=Address.CAT_IPV4) 
    addr.condition = "Equals"
    
     # Create an Indicator with the File Hash Object created above.
    indicator = Indicator()
    indicator.title = "URL-" + str(ip)
    indicator.description = ("Malicious URL " + str(ip) + " reported from " + provider)
    indicator.set_producer_identity(provider)
    indicator.set_produced_time(reporttime)
    indicator.add_observable(addr)
    # Create a STIX Package
    stix_package = STIXPackage()
    
    stix_package.add(et)
    stix_package.add(indicator)
    
    # Print the XML!
    #print(stix_package.to_xml())
    f = open('/opt/TARDIS/Observables/URL/' + str(ip) + '.xml','w')
    f.write(stix_package.to_xml())
    f.close()

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def main():
    # Create a CyboX File Object
    f = File()

    # This automatically detects that it's an MD5 hash based on the length
    f.add_hash("4EC0027BEF4D7E1786A04D021FA8A67F")

    # Create an Indicator with the File Hash Object created above.
    indicator = Indicator()
    indicator.title = "File Hash Example"
    indicator.description = (
        "An indicator containing a File observable with an associated hash"
    )
    indicator.set_producer_identity("The MITRE Corporation")
    indicator.set_produced_time(utils.dates.now())

    # Add The File Object to the Indicator. This will promote the CybOX Object
    # to a CybOX Observable internally.
    indicator.add_object(f)

    # Create a STIX Package
    stix_package = STIXPackage()

    # Create the STIX Header and add a description.
    stix_header = STIXHeader()
    stix_header.description = "File Hash Indicator Example"
    stix_package.stix_header = stix_header

    # Add our Indicator object. The add() method will inspect the input and
    # append it to the `stix_package.indicators` collection.
    stix_package.add(indicator)

    # Print the XML!
    print(stix_package.to_xml())

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def md5(hash,provider,reporttime):
    vuln = Vulnerability()
    vuln.cve_id = "MD5-" + hash
    vuln.description = "maliciousMD5"
    et = ExploitTarget(title=provider + " observable")
    et.add_vulnerability(vuln) 
    # Create a CyboX File Object
    f = File()
    # This automatically detects that it's an MD5 hash based on the length
    f.add_hash(hash)
    
    # Create an Indicator with the File Hash Object created above.
    indicator = Indicator()
    indicator.title = "MD5-" + hash
    indicator.description = ("Malicious hash " + hash + " reported from " + provider)
    indicator.set_producer_identity(provider)
    indicator.set_produced_time(reporttime)

    
    # Add The File Object to the Indicator. This will promote the CybOX Object
    # to a CybOX Observable internally.
    
    indicator.add_observable(f)

    # Create a STIX Package
    stix_package = STIXPackage()
    
    stix_package.add(et)
    stix_package.add(indicator)
    
    # Print the XML!
    #print(stix_package.to_xml())
    f = open('/opt/TARDIS/Observables/MD5/' + hash + '.xml','w')
    f.write(stix_package.to_xml())
    f.close()

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def main():
    # Create our CybOX Simple Hash Value
    shv = Hash()
    shv.simple_hash_value = "4EC0027BEF4D7E1786A04D021FA8A67F"

    # Create a CybOX File Object and add the Hash we created above.
    f = File()
    h = Hash(shv, Hash.TYPE_MD5)
    f.add_hash(h)

    # Create the STIX Package
    stix_package = STIXPackage()

    # Create the STIX Header and add a description.
    stix_header = STIXHeader()
    stix_header.description = "Simple File Hash Observable Example"
    stix_package.stix_header = stix_header

    # Add the File Hash Observable to the STIX Package. The add() method will
    # inspect the input and add it to the top-level stix_package.observables
    # collection.
    stix_package.add(f)

    # Print the XML!
    print(stix_package.to_xml())

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def fqdn(fqdn,provider,reporttime):
    currentTime = time.time()
    parsed_uri = urlparse( str(fqdn) )
    domain = '{uri.scheme}://{uri.netloc}/'.format(uri=parsed_uri)
    if domain.startswith('https'):
        domain = domain[8:]
    else:
        domain = domain[7:]
    if domain.endswith('/'):
        domain = domain[:-1]


    vuln = Vulnerability()
    vuln.cve_id = "FQDN-" + str(domain) + '_' + str(currentTime)
    vuln.description = "maliciousIPV4"
    et = ExploitTarget(title=provider + " observable")
    et.add_vulnerability(vuln)
    
    url = URI()
    url.value = fqdn
    url.type_ =  URI.TYPE_URL
    url.condition = "Equals"
    
     # Create an Indicator with the File Hash Object created above.
    indicator = Indicator()
    indicator.title = "FQDN-" + str(fqdn)
    indicator.description = ("Malicious FQDN " + str(fqdn) + " reported from " + provider)
    indicator.set_producer_identity(provider)
    indicator.set_produced_time(reporttime)
    indicator.add_observable(url)
    # Create a STIX Package
    stix_package = STIXPackage()
    
    stix_package.add(et)
    stix_package.add(indicator)
    
    # Print the XML!
    #print(stix_package.to_xml())
    
    
    f = open('/opt/TARDIS/Observables/FQDN/' + str(domain) + '_' + str(currentTime) + '.xml','w')
    f.write(stix_package.to_xml())
    f.close()

    

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def main():
    # Create a CybOX File Object with a contained hash
    f = File()
    f.add_hash("4EC0027BEF4D7E1786A04D021FA8A67F")

    # Create an Indicator with the File Hash Object created above.
    indicator = Indicator()
    indicator.title = "File Hash Example"
    indicator.description = (
        "An indicator containing a File observable with an associated hash"
    )
    indicator.set_producer_identity("The MITRE Corporation")
    indicator.set_produced_time(utils.dates.now())

    # Add The File Object to the Indicator. This will promote the CybOX Object
    # to a CybOX Observable internally.
    indicator.add_object(f)

    # Build our STIX CIQ Identity object
    party_name = stix_ciq.PartyName(
        name_lines=("Foo", "Bar"),
        person_names=("John Smith", "Jill Smith"),
        organisation_names=("Foo Inc.", "Bar Corp.")
    )
    ident_spec = stix_ciq.STIXCIQIdentity3_0(party_name=party_name)
    ident_spec.add_electronic_address_identifier("[email protected]")
    ident_spec.add_free_text_line("Demonstrating Free Text!")
    ident_spec.add_contact_number("555-555-5555")
    ident_spec.add_contact_number("555-555-5556")

    # Build and add a CIQ Address
    addr = stix_ciq.Address(
        free_text_address='1234 Example Lane.',
        country='USA',
        administrative_area='An Admin Area'
    )
    ident_spec.add_address(addr)

    # Build and add a nationality
    nationality = stix_ciq.Country("Norway")
    ident_spec.add_nationality(nationality)

    identity = stix_ciq.CIQIdentity3_0Instance(specification=ident_spec)

    # Set the Indicator producer identity to our CIQ Identity
    indicator.set_producer_identity(identity)

    # Build our STIX Package
    stix_package = STIXPackage()

    # Build a STIX Header and add a description
    stix_header = STIXHeader()
    stix_header.description = "STIX CIQ Identity Extension Example"

    # Set the STIX Header on our STIX Package
    stix_package.stix_header = stix_header

    # Add our Indicator object. The add() method will inspect the input and
    # append it to the `stix_package.indicators` collection.
    stix_package.add(indicator)
    
    # Print the XML!
    print(stix_package.to_xml())

    # Print a dictionary!
    pprint(stix_package.to_dict())

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
class PackageBuilder(object):
    def __init__(self, alert):
    
        self.__urls = set()
        self.__domains = set()
        self.__ipv4 = set()
        self.__hashes = set()
        self.__regkeys = set()
        self.__files = set()
        self.__emails = set()

        PRODUCER_NAME = alert.product
        
        # Domains
        domain_indicator = Indicator()
        domain_indicator.title = "Malware Artifacts - Domain"
        domain_indicator.type = "Malware Artifacts"
        domain_indicator.description = ("Domains derived from sandboxed malware sample.  AlertID: %d" % alert.id)
        domain_indicator.short_description = ("Domains from %d" % alert.id)
        domain_indicator.set_producer_identity(PRODUCER_NAME)
        domain_indicator.set_produced_time(utils.dates.now())
        domain_indicator.indicator_types.append(IndicatorType_1_1.TERM_DOMAIN_WATCHLIST)
        self.domain_indicator = domain_indicator

        # IPs
        ip_indicator = Indicator()
        ip_indicator.title = "Malware Artifacts - IP"
        ip_indicator.description = ("IPs derived from sandboxed malware sample. AlertID: %d" % alert.id)
        ip_indicator.short_description = ("IPs from %d" % alert.id)
        ip_indicator.set_producer_identity(PRODUCER_NAME)
        ip_indicator.set_produced_time(utils.dates.now())
        ip_indicator.indicator_types.append(IndicatorType_1_1.TERM_IP_WATCHLIST)
        self.ip_indicator = ip_indicator

        # URLs
        url_indicator = Indicator()
        url_indicator.title = "Malware Artifacts - URL"
        url_indicator.description = ("URLs derived from sandboxed malware sample. AlertID: %d" % alert.id)
        url_indicator.short_description = ("URLs from %d" % alert.id)
        url_indicator.set_producer_identity(PRODUCER_NAME)
        url_indicator.set_produced_time(utils.dates.now())
        url_indicator.indicator_types.append(IndicatorType_1_1.TERM_URL_WATCHLIST)
        self.url_indicator = url_indicator

        # Hashs
        hash_indicator = Indicator()
        hash_indicator.title = "Malware Artifacts - Files"
        hash_indicator.description = ("Files  derived from sandboxed malware sample. AlertID: %d" % alert.id)
        hash_indicator.short_description = ("File from %d" % alert.id)
        hash_indicator.set_producer_identity(PRODUCER_NAME)
        hash_indicator.set_produced_time(utils.dates.now())
        hash_indicator.indicator_types.append(IndicatorType_1_1.TERM_FILE_HASH_WATCHLIST)
        self.hash_indicator = hash_indicator

        # Registry
        reg_indicator = Indicator()
        reg_indicator.title = "Malware Artifacts - Registry entries"
        reg_indicator.description = ("File hashes derived from sandboxed malware sample. AlertID: %d" % alert.id)
        reg_indicator.short_description = ("Registry entries from %d" % alert.id)
        reg_indicator.set_producer_identity(PRODUCER_NAME)
        reg_indicator.set_produced_time(utils.dates.now())
        reg_indicator.indicator_types.append(IndicatorType_1_1.TERM_MALWARE_ARTIFACTS)
        self.reg_indicator = reg_indicator

        # email_indicator
        email_indicator = Indicator()
        email_indicator.title = "Malware Artifacts - Malicious "
        email_indicator.description = ("Email headers. AlertID: %d" % alert.id)
        email_indicator.short_description = ("Email headers from %d" % alert.id)
        email_indicator.set_producer_identity(PRODUCER_NAME)
        email_indicator.set_produced_time(utils.dates.now())
        email_indicator.indicator_types.append(IndicatorType_1_1.TERM_MALICIOUS_EMAIL )
        self.email_indicator = email_indicator
        
        # Create a STIX Package
        self.stix_package = STIXPackage()

        # Create the STIX Header and add a description.
        stix_header = STIXHeader({"Indicators - Malware Artifacts"})
        stix_header.description = "FireEye Sample ID %d" % alert.id
        self.stix_package.stix_header = stix_header    
        
    def add_ipv4_observable(self, ipv4_address):
        if ipv4_address in self.__ipv4:
            return
        self.__ipv4.add(ipv4_address)
        ipv4_object = Address.from_dict({'address_value': ipv4_address, 'category': Address.CAT_IPV4})
        ipv4_observable = Observable(ipv4_object)
        ipv4_observable.title = "Malware Artifact - IP"
        ipv4_observable.description = "IP derived from sandboxed malware sample."
        ipv4_observable.short_description = "IP from malware."
        self.ip_indicator.add_observable(ipv4_observable)

    def add_domain_name_observable(self, domain_name):
        if domain_name in self.__domains:
            return
        self.__domains.add(domain_name)
        domain_name_object = URI.from_dict({'value': domain_name, 'type': URI.TYPE_DOMAIN})
        domain_name_observable = Observable(domain_name_object)
        domain_name_observable.title = "Malware Artifact - Domain"
#.........这里部分代码省略.........

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add [as 别名]
def create_stix_file():
    # List of indicators to be deduped
    hostnames = []
    ips = []
    urls = []
    md5s = []
    sha1s = []

    # Set namespace
    NAMESPACE = {PRODUCER_URL: PRODUCER_NAME}
    set_id_namespace(NAMESPACE)

    # JSON load the POSTed request data
    try:
        data_recv = request.data
        data = json.loads(data_recv)
    except:
        return make_response(jsonify({"Error": "Unable to decode json object"}), 400)

    # Parse the JSON object
    try:
        # Get MD5 of sample
        malware_sample = data["alert"]["explanation"]["malware-detected"]["malware"]
        count = 0
        sample_hash = ""

        try:
            for entry in malware_sample:
                if "md5sum" in malware_sample[count]:
                    sample_hash = malware_sample[count]["md5sum"]
                count += 1
        except:
            if "md5sum" in malware_sample:
                sample_hash = malware_sample["md5sum"]

        # If all else fails
        if sample_hash == "":
            sample_hash = "Unknown"

        # Indicators

        # Domains
        domain_indicator = Indicator()
        domain_indicator.title = "Malware Artifacts - Domain"
        domain_indicator.type = "Malware Artifacts"
        domain_indicator.description = "Domains derived from sandboxed malware sample.  MD5 Hash: " + sample_hash
        domain_indicator.short_description = "Domainss from " + sample_hash
        domain_indicator.set_producer_identity(PRODUCER_NAME)
        domain_indicator.set_produced_time(utils.dates.now())
        domain_indicator.indicator_types.append("Domain Watchlist")

        # IPs
        ip_indicator = Indicator()
        ip_indicator.title = "Malware Artifacts - IP"
        ip_indicator.description = "IPs derived from sandboxed malware sample.  MD5 Hash: " + sample_hash
        ip_indicator.short_description = "IPs from " + sample_hash
        ip_indicator.set_producer_identity(PRODUCER_NAME)
        ip_indicator.set_produced_time(utils.dates.now())
        ip_indicator.indicator_types.append("IP Watchlist")

        # URLs
        url_indicator = Indicator()
        url_indicator.title = "Malware Artifacts - URL"
        url_indicator.description = "URLs derived from sandboxed malware sample.  MD5 Hash: " + sample_hash
        url_indicator.short_description = "URLs from " + sample_hash
        url_indicator.set_producer_identity(PRODUCER_NAME)
        url_indicator.set_produced_time(utils.dates.now())
        url_indicator.indicator_types.append("URL Watchlist")

        # Hashs
        hash_indicator = Indicator()
        hash_indicator.title = "Malware Artifacts - File Hash"
        hash_indicator.description = "File hashes derived from sandboxed malware sample.  MD5 Hash: " + sample_hash
        hash_indicator.short_description = "Hash from " + sample_hash
        hash_indicator.set_producer_identity(PRODUCER_NAME)
        hash_indicator.set_produced_time(utils.dates.now())
        hash_indicator.indicator_types.append("File Hash Watchlist")

        # Create a STIX Package
        stix_package = STIXPackage()

        # Create the STIX Header and add a description.
        stix_header = STIXHeader({"Indicators - Malware Artifacts"})
        stix_header.description = PRODUCER_NAME + ": FireEye Sample ID " + str(data["alert"]["id"])
        stix_package.stix_header = stix_header

        if "network" in data["alert"]["explanation"]["os-changes"]:
            # Add indicators for network
            for entry in data["alert"]["explanation"]["os-changes"]["network"]:
                if "hostname" in entry:
                    hostnames.append(entry["hostname"])
                if "ipaddress" in entry:
                    ips.append(entry["ipaddress"])
                if "http_request" in entry:
                    domain = re.search("~~Host:\s(.*?)~~", entry["http_request"])
                    url = re.search("^.*\s(.*?)\sHTTP", entry["http_request"])
                    if domain:
                        domain_name = domain.group(1)
                    if url:
                        url_string = url.group(1)
#.........这里部分代码省略.........