Python STIXPackage.add_incident方法代码示例

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def main():
    pkg = STIXPackage()
    affected_asset = AffectedAsset()
    affected_asset.description = "Database server at hr-data1.example.com"
    affected_asset.type_ = "Database"
    affected_asset.type_.count_affected = 1
    affected_asset.business_function_or_role = "Hosts the database for example.com"
    affected_asset.ownership_class = "Internally-Owned"
    affected_asset.management_class = "Internally-Managed"
    affected_asset.location_class = "Internally-Located"

    property_affected = PropertyAffected()
    property_affected.property_ = "Confidentiality"
    property_affected.description_of_effect = "Data was exfiltrated, has not been determined which data or how."
    property_affected.non_public_data_compromised = "Yes"
    property_affected.non_public_data_compromised.data_encrypted = False

    security_effect_nature = NatureOfSecurityEffect()
    security_effect_nature.append(property_affected)

    affected_asset.nature_of_security_effect = security_effect_nature
    affected_assets = AffectedAssets()
    affected_assets.append(affected_asset)
    incident = Incident(title="Exfiltration from hr-data1.example.com")
    incident.affected_assets = affected_assets

    pkg.add_incident(incident)

    print(pkg.to_xml(encoding=None))

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def stix_pkg(config, src, endpoint, payload, title='random test data',
             description='random test data',
             package_intents='Indicators - Watchlist',
             tlp_color='WHITE', dest=None):
    '''package observables'''
    # setup the xmlns...
    xmlns_url = config['edge']['sites'][dest]['stix']['xmlns_url']
    xmlns_name = config['edge']['sites'][dest]['stix']['xmlns_name']
    set_stix_id_namespace({xmlns_url: xmlns_name})
    set_cybox_id_namespace(Namespace(xmlns_url, xmlns_name))
    # construct a stix package...
    stix_package = STIXPackage()
    stix_header = STIXHeader()
    stix_header.title = title
    stix_header.description = description
    stix_header.package_intents = package_intents
    marking = MarkingSpecification()
    marking.controlled_structure = '../../../../descendant-or-self::node()'
    tlp_marking = TLPMarkingStructure()
    tlp_marking.color = tlp_color
    marking.marking_structures.append(tlp_marking)
    stix_package.stix_header = stix_header
    stix_package.stix_header.handling = Marking()
    stix_package.stix_header.handling.add_marking(marking)
    if isinstance(payload, Observable):
        stix_package.add_observable(payload)
    elif isinstance(payload, Indicator):
        stix_package.add_indicator(payload)
    elif isinstance(payload, Incident):
        stix_package.add_incident(payload)
    return(stix_package)

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def main():

    data = json.load(open("data.json"))

    stix_package = STIXPackage(stix_header=STIXHeader(title=data['title'], package_intents='Incident'))

    ttps = {}

    for info in data['ips']:
        if info['bot'] not in ttps:
            ttps[info['bot']] = TTP(title=info['bot'])
            stix_package.add_ttp(ttps[info['bot']])

        incident = Incident(title=info['ip'])
        incident.time = Time()
        incident.time.first_malicious_action = info['first_seen']

        addr = Address(address_value=info['ip'], category=Address.CAT_IPV4)
        observable = Observable(item=addr)
        stix_package.add_observable(observable)

        related_ttp = RelatedTTP(TTP(idref=ttps[info['bot']].id_), relationship="Used Malware")
        incident.leveraged_ttps.append(related_ttp)

        related_observable = RelatedObservable(Observable(idref=observable.id_))
        incident.related_observables.append(related_observable)

        stix_package.add_incident(incident)

    print(stix_package.to_xml(encoding=None))

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def buildSTIX(ident,confid,restconfid, effect, resteffect,typeIncident,resttype,asset,restasset,hashPkg):
    # IMPLEMENTATION WORKAROUND - 
    # restConfid --> header.description
    # resteffect --> breach.description
    # resttype --> reporter.description
    # restasset --> reporter.identity.name 
    # setup stix document
    stix_package = STIXPackage()
    stix_header = STIXHeader()
    stix_header.description = restconfid # "Example description"
    stix_package.stix_header = stix_header
    # add incident and confidence
    breach = Incident(id_=ident)
    breach.description = resteffect # "Intrusion into enterprise network"
    breach.confidence = Confidence()
    breach.confidence.value=confid
    breach._binding_class.xml_type = typeIncident
    # stamp with reporter
    breach.reporter = InformationSource()
    breach.reporter.description = resttype #"The person who reported it"

    breach.reporter.time = Time()
    breach.reporter.time.produced_time = datetime.strptime("2014-03-11","%Y-%m-%d") # when they submitted it

    breach.reporter.identity = Identity()
    breach.reporter.identity.name = restasset # "Sample Investigations, LLC"

    # set incident-specific timestamps
    breach.time = incidentTime()
    breach.title = "Breach of CyberTech Dynamics"
    breach.time.initial_compromise = datetime.strptime("2012-01-30", "%Y-%m-%d") 
    breach.time.incident_discovery = datetime.strptime("2012-05-10", "%Y-%m-%d") 
    breach.time.restoration_achieved = datetime.strptime("2012-08-10", "%Y-%m-%d") 
    breach.time.incident_reported = datetime.strptime("2012-12-10", "%Y-%m-%d") 

    # add the impact
    #impact = ImpactAssessment()
    #impact.add_effect("Unintended Access")
    #breach.impact_assessment = impact
    affected_asset = AffectedAsset()
    affected_asset.description = "Database server at hr-data1.example.com" 
    affected_asset.type_ = asset
    
    breach.affected_assets = affected_asset
    #print("asset type: %s"%(breach.affected_assets[0].type_))
    # add the victim
    breach.add_victim (hashPkg)

    # add the impact
    impact = ImpactAssessment()
    impact.add_effect(effect)
    breach.impact_assessment = impact

    stix_package.add_incident(breach)
    #print("hey, I've got an incident! list size=%s"%(len(stix_package._incidents)))

    # Print the XML!
    #print(stix_package.to_xml())
    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def build_stix( input_dict ):
    # setup stix document
    stix_package = STIXPackage()
    stix_header = STIXHeader()

    stix_header.description = "Incident report for " + input_dict['organization']
    stix_header.add_package_intent ("Incident")

    # Add handling requirements if needed
    if input_dict['sensitive'] == "True":
        mark = SimpleMarkingStructure()
        mark.statement = "Sensitive"
        mark_spec = MarkingSpecification()
        mark_spec.marking_structures.append(mark)
        stix_header.handling = Marking(mark_spec)


    stix_package.stix_header = stix_header

    # add incident and confidence
    incident = Incident()
    incident.description = input_dict['description']
    incident.confidence = input_dict['confidence']

    # add incident reporter
    incident.reporter = InformationSource()
    incident.reporter.description = "Person who reported the incident"

    incident.reporter.time = Time()
    incident.reporter.time.produced_time = datetime.strptime(input_dict['timestamp'], "%Y-%m-%d") # when they submitted it

    incident.reporter.identity = Identity()
    incident.reporter.identity.name = input_dict['submitter']

    # incident time is a complex object with support for a bunch of different "when stuff happened" items
    incident.time = incidentTime()
    incident.title = "Breach of " + input_dict['organization']
    incident.time.incident_discovery = datetime.strptime(input_dict['timestamp'], "%Y-%m-%d") # when they submitted it

    # add the impact
    impact = ImpactAssessment()
    impact.add_effect(input_dict['damage'])
    incident.impact_assessment = impact

    #Add the thing that was stolen
    jewels = AffectedAsset()
    jewels.type_ = input_dict['asset']
    incident.add_affected_asset (jewels)

    # add the victim
    incident.add_victim (input_dict['organization'])

    stix_package.add_incident(incident)

    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def generateEventPackage(event):
    package_name = namespace[1] + ':STIXPackage-' + event["Event"]["uuid"]
    stix_package = STIXPackage(id_=package_name)
    stix_header = STIXHeader()
    stix_header.title="MISP event #" + event["Event"]["id"] + " uuid: " + event["Event"]["uuid"]
    stix_header.package_intents="Threat Report"
    stix_package.stix_header = stix_header
    objects = generateSTIXObjects(event)
    incident = objects[0]
    ttps = objects[1]
    stix_package.add_incident(incident)
    for ttp in ttps:
        stix_package.add_ttp(ttp)
    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def generateEventPackage(event):
    package_name = namespace[1] + ":STIXPackage-" + event["Event"]["uuid"]
    timestamp = getDateFromTimestamp(int(event["Event"]["timestamp"]))
    stix_package = STIXPackage(id_=package_name, timestamp=timestamp)
    stix_header = STIXHeader()
    stix_header.title = event["Event"]["info"] + " (MISP Event #" + event["Event"]["id"] + ")"
    stix_header.package_intents = "Threat Report"
    stix_package.stix_header = stix_header
    objects = generateSTIXObjects(event)
    incident = objects[0]
    ttps = objects[1]
    stix_package.add_incident(incident)
    for ttp in ttps:
        stix_package.add_ttp(ttp)
    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def build_stix():
    # setup stix document
    stix_package = STIXPackage()

    # add incident and confidence
    breach = Incident()
    breach.description = "Intrusion into enterprise network"
    breach.confidence = "High"

    # stamp with reporter
    breach.reporter = InformationSource()
    breach.reporter.description = "The person who reported it"

    breach.reporter.time = Time()
    breach.reporter.time.produced_time = datetime.strptime("2014-03-11", "%Y-%m-%d")  # when they submitted it

    breach.reporter.identity = Identity()
    breach.reporter.identity.name = "Sample Investigations, LLC"

    # set incident-specific timestamps
    breach.time = incidentTime()
    breach.title = "Breach of CyberTech Dynamics"
    breach.time.initial_compromise = datetime.strptime("2012-01-30", "%Y-%m-%d")
    breach.time.incident_discovery = datetime.strptime("2012-05-10", "%Y-%m-%d")
    breach.time.restoration_achieved = datetime.strptime("2012-08-10", "%Y-%m-%d")
    breach.time.incident_reported = datetime.strptime("2012-12-10", "%Y-%m-%d")

    # add the impact
    impact = ImpactAssessment()
    impact.effects = Effects("Unintended Access")
    breach.impact_assessment = impact

    # add the victim
    victim = Identity()
    victim.name = "CyberTech Dynamics"
    breach.add_victim(victim)

    # add the impact
    impact = ImpactAssessment()
    impact.effects = Effects("Financial Loss")
    breach.impact_assessment = impact

    stix_package.add_incident(breach)

    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def main():
    malware = MalwareInstance()
    malware.add_name("Poison Ivy")
    malware.add_type("Remote Access Trojan")
    
    ttp = TTP(title="Poison Ivy")
    ttp.behavior = Behavior()
    ttp.behavior.add_malware_instance(malware)
    
    incident = Incident(title="Detected Poison Ivy beaconing through perimeter firewalls")
    related_ttp = RelatedTTP(TTP(idref=ttp.id_), relationship="Uses Malware")
    incident.leveraged_ttps.append(related_ttp)
    
    stix_package = STIXPackage()
    stix_package.add_ttp(ttp)
    stix_package.add_incident(incident)
    
    print stix_package.to_xml() 

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def build_stix( ):
    # setup stix document
    stix_package = STIXPackage()
    stix_header = STIXHeader()

    stix_header.description = "Sample breach report" 
    stix_header.add_package_intent ("Incident")

    stix_package.stix_header = stix_header

    # add incident and confidence
    breach = Incident()
    breach.description = "Intrusion into enterprise network"
    breach.confidence = "High"

    # stamp with reporter
    breach.reporter = InformationSource()
    breach.reporter.description = "The person who reported it"

    breach.reporter.time = Time()
    breach.reporter.time.produced_time = datetime.strptime("2014-03-11","%Y-%m-%d") # when they submitted it

    breach.reporter.identity = Identity()
    breach.reporter.identity.name = "Sample Investigations, LLC"


    # incident time is a complex object with support for a bunch of different "when stuff happened" items
    breach.time = incidentTime()
    breach.title = "Breach of Canary Corp"
    breach.time.incident_discovery = datetime.strptime("2013-01-13", "%Y-%m-%d") # when they submitted it

    # add the impact
    impact = ImpactAssessment()
    impact.add_effect("Financial Loss")
    breach.impact_assessment = impact

    # add the victim
    breach.add_victim ("Canary Corp")

    stix_package.add_incident(breach)

    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def build_stix( ):
    # setup stix document
    stix_package = STIXPackage()
    stix_header = STIXHeader()

    stix_header.description = "Sample breach report" 
    stix_header.add_package_intent ("Incident")

    # stamp with creator
    stix_header.information_source = InformationSource()
    stix_header.information_source.description = "The person who reported it"

    stix_header.information_source.identity = Identity()
    stix_header.information_source.identity.name = "Infosec Operations Team"

    stix_package.stix_header = stix_header

    # add incident and confidence
    breach = Incident()
    breach.description = "Intrusion into enterprise network"
    breach.confidence = "High"

    # set incident-specific timestamps
    breach.time = incidentTime()
    breach.title = "Breach of Cyber Tech Dynamics"
    breach.time.initial_compromise = datetime.strptime("2012-01-30", "%Y-%m-%d") 
    breach.time.incident_discovery = datetime.strptime("2012-05-10", "%Y-%m-%d") 
    breach.time.restoration_achieved = datetime.strptime("2012-08-10", "%Y-%m-%d") 
    breach.time.incident_reported = datetime.strptime("2012-12-10", "%Y-%m-%d") 

    # add the impact
    impact = ImpactAssessment()
    impact.add_effect("Unintended Access")
    breach.impact_assessment = impact

    # add the victim
    breach.add_victim ("Cyber Tech Dynamics")

    stix_package.add_incident(breach)

    return stix_package

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def main():
    pkg = STIXPackage()
    file_object1 = File()
    file_object1.file_name = "readme.doc.exe"
    file_object1.size_in_bytes = 40891
    file_object1.add_hash(Hash("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"))
    observable1 = Observable(file_object1)

    file_object2 = File()
    file_object2.file_name = "readme.doc.exe"
    file_object2.size_in_bytes = 40891
    file_object2.add_hash(Hash("d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592"))
    observable2 = Observable(file_object2)

    incident = Incident(title="Malicious files detected")

    related_observable1 = RelatedObservable(observable1, relationship="Malicious Artifact Detected")
    related_observable2 = RelatedObservable(observable2, relationship="Malicious Artifact Detected")
    incident.related_observables.append(related_observable1)
    incident.related_observables.append(related_observable2)

    pkg.add_incident(incident)

    print(pkg.to_xml(encoding=None))

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
    def transform(self, event):
        self._set_namespace(self.config['contact_domain'], self.config['contact_name'])
        stix_package = STIXPackage()
        self._add_header(stix_package, "Unauthorized traffic to honeypot", "Describes one or more honeypot incidents")

        incident = Incident(id_="%s:%s-%s" % (self.config['contact_name'], 'incident', event['session_id']))
        initial_time = StixTime()
        initial_time.initial_compromise = event['timestamp'].isoformat()
        incident.time = initial_time
        incident.title = "Conpot Event"
        incident.short_description = "Traffic to Conpot ICS honeypot"
        incident.add_category(VocabString(value='Scans/Probes/Attempted Access'))

        tool_list = ToolInformationList()
        tool_list.append(ToolInformation.from_dict({
            'name': "Conpot",
            'vendor': "Conpot Team",
            'version': conpot.__version__,
            'description': textwrap.dedent('Conpot is a low interactive server side Industrial Control Systems '
                                           'honeypot designed to be easy to deploy, modify and extend.')
        }))
        incident.reporter = InformationSource(tools=tool_list)

        incident.add_discovery_method("Monitoring Service")
        incident.confidence = "High"

        # Victim Targeting by Sector
        ciq_identity = CIQIdentity3_0Instance()
        #identity_spec = STIXCIQIdentity3_0()
        #identity_spec.organisation_info = OrganisationInfo(industry_type="Electricity, Industrial Control Systems")
        #ciq_identity.specification = identity_spec
        ttp = TTP(title="Victim Targeting: Electricity Sector and Industrial Control System Sector")
        ttp.victim_targeting = VictimTargeting()
        ttp.victim_targeting.identity = ciq_identity

        incident.leveraged_ttps.append(ttp)

        indicator = Indicator(title="Conpot Event")
        indicator.description = "Conpot network event"
        indicator.confidence = "High"
        source_port = Port.from_dict({'port_value': event['remote'][1], 'layer4_protocol': 'tcp'})
        dest_port = Port.from_dict({'port_value': self.protocol_to_port_mapping[event['data_type']],
                                    'layer4_protocol': 'tcp'})
        source_ip = Address.from_dict({'address_value': event['remote'][0], 'category': Address.CAT_IPV4})
        dest_ip = Address.from_dict({'address_value': event['public_ip'], 'category': Address.CAT_IPV4})
        source_address = SocketAddress.from_dict({'ip_address': source_ip.to_dict(), 'port': source_port.to_dict()})
        dest_address = SocketAddress.from_dict({'ip_address': dest_ip.to_dict(), 'port': dest_port.to_dict()})
        network_connection = NetworkConnection.from_dict(
            {'source_socket_address': source_address.to_dict(),
             'destination_socket_address': dest_address.to_dict(),
             'layer3_protocol': u"IPv4",
             'layer4_protocol': u"TCP",
             'layer7_protocol': event['data_type'],
             'source_tcp_state': u"ESTABLISHED",
             'destination_tcp_state': u"ESTABLISHED",
             }
        )
        indicator.add_observable(Observable(network_connection))

        artifact = Artifact()
        artifact.data = json.dumps(event['data'])
        artifact.packaging.append(ZlibCompression())
        artifact.packaging.append(Base64Encoding())
        indicator.add_observable(Observable(artifact))

        incident.related_indicators.append(indicator)
        stix_package.add_incident(incident)

        stix_package_xml = stix_package.to_xml()
        return stix_package_xml

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
	def parse(self, argument_log):

		"""
		Parses Suricata IDS log lines into STIX/CybOX format.

		:param argument_log: The log line to try and identify
		:return: STIX Incident 
			
		"""
		argument_log = " ".join(argument_log.split(" ")[5:])
		parsed_suricata_log = {}

		for regex in self._regex:

			try:
				parsed_suricata_log[regex] = re.match(self._regex[regex], argument_log).group(1)
			except:
				print "Failed to parse %s" % (regex)
				return False

		#TODO: Time Zones
		parsed_suricata_log["unix_timestamp"] = time.mktime(datetime.datetime.strptime(parsed_suricata_log["time"], "%m/%d/%Y-%H:%M:%S").timetuple())

		# Find IP's of interest
		if IPAddress(parsed_suricata_log["source_ip"]).is_private() == False or IPAddress(parsed_suricata_log["destination_ip"]).is_private() == False:

			# Name Space
			stix.utils.idgen.set_id_namespace(Namespace(self._config["NAMESPACE"]["url"], self._config["NAMESPACE"]["name"],""))

			stix_package = STIXPackage()

			# If the source is public
			if not IPAddress(parsed_suricata_log["source_ip"]).is_private() and IPAddress(parsed_suricata_log["destination_ip"]).is_private():

				incident = Incident(title="[IDS Alert] "+parsed_suricata_log["text"]+" From "+ parsed_suricata_log["source_ip"])

				addr = Address(address_value=parsed_suricata_log["source_ip"], category=Address.CAT_IPV4)

			elif IPAddress(parsed_suricata_log["source_ip"]).is_private() and not IPAddress(parsed_suricata_log["destination_ip"]).is_private():

				incident = Incident(title="[IDS Alert] "+parsed_suricata_log["text"]+" To "+ parsed_suricata_log["destination_ip"])

				addr = Address(address_value=parsed_suricata_log["destination_ip"], category=Address.CAT_IPV4)
			
			else:

				#public to public - i can't tell who the bad guy is
				return False

			observable = Observable(item=addr,
									title="[IP Associated To IDS Alert] "+parsed_suricata_log["text"],
									description="""This ip address was seen to be involved in triggering the IDS alert %s if 
seen from multiple sources, this is a good indicator of a potential threat actor or compromised host""" % (parsed_suricata_log["text"]))
			stix_package.add_observable(observable)

			incident.time = Time()
			incident.time.first_malicious_action = parsed_suricata_log["time"]

			related_observable = RelatedObservable(Observable(idref=observable.id_))
			incident.related_observables.append(related_observable)

			stix_package.add_incident(incident)

		return stix_package.to_xml()

# 需要导入模块: from stix.core import STIXPackage [as 别名]
# 或者: from stix.core.STIXPackage import add_incident [as 别名]
def convert_file(ifn, ofn, vcdb):
    global cve_info
    global targets_item
    cve_info = []
    targets_item = None
    with open(ifn) as json_data:
        veris_item = json.load(json_data)
        json_data.close()
    schema_version_item = veris_item.get("schema_version")
    if not schema_version_item:
        error("The 'schema_version' item is required")
    elif not (schema_version_item == "1.3" or schema_version_item == "1.3.0"):
        error("This converter is for VERIS schema version 1.3.  This file has schema version " + schema_version_item)
        return
    pkg = STIXPackage()
    action_item = veris_item.get('action')
    if not action_item:
        error("The 'action' item is required")
    else:
        add_action_item(action_item, pkg)
    add_cve_info(pkg)
    actor_item = veris_item.get('actor')
    if not actor_item:
        error("The 'actor' item is required")
    else:
        add_actor_item(actor_item, pkg)
    incident = Incident()
    pkg.add_incident(incident)
    asset_item = veris_item.get('asset')
    if not asset_item:
        error("The 'asset' item is required")
    else:
        attribute_item = veris_item.get('attribute')
        add_asset_item(asset_item, attribute_item, incident)
    # added as 1.3
    campaign_id_item = veris_item.get('campaign_id')
    if campaign_id_item:
        add_campaign_item(campaign_id_item, pkg)
    confidence_item = veris_item.get('confidence')
    if confidence_item:
        add_confidence_item(confidence_item, incident)
    #control_failure - not found in data
    if veris_item.get('control_failure'):
        warn("'control_failure' item not handled, yet")
    corrective_action_item = veris_item.get('corrective_action')
    cost_corrective_action_item = veris_item.get('cost_corrective_action')
    if corrective_action_item  or cost_corrective_action_item:
        add_coa_items(corrective_action_item, cost_corrective_action_item, pkg)
    discovery_method_item = veris_item.get('discovery_method')
    if not discovery_method_item:
        error("The 'discovery_method' item is required")
    else:
        incident.add_discovery_method(map_discovey_method(discovery_method_item))
    discovery_notes_item = veris_item.get('discovery_notes') 
    if discovery_notes_item:
        warn("'discovery_notes' item not handled yet")
    impact_item = veris_item.get('impact')    
    if impact_item:
        add_impact_item(impact_item, incident)  
    incident_id_item = veris_item.get('incident_id') 
    if not incident_id_item:
        error("The 'incident_id' item is required")
    else:
        external_id = ExternalID()
        external_id.value = incident_id_item
        external_id.source = "VERIS" 
        incident.add_external_id(external_id)
    notes_item = veris_item.get('notes')      
    if notes_item:
        pkg.stix_header = STIXHeader()
        pkg.stix_header.title = "Notes: " + notes_item
    # plus item for records from VCDB have some known useful information 
    if vcdb:
        plus_item = veris_item.get('plus')
        if plus_item:
            add_plus_item(plus_item, incident, pkg)
    # removed as of 1.3 - see campaign_id
    # related_incidents_item = veris_item.get('related_incidents')
    # if related_incidents_item:
    #    add_related_incidents_item(related_incidents_item, incident)
    
    security_incident_item = veris_item.get('security_incident')
    if not security_incident_item:
        error("The 'security_incident' item is required")
    else:
        incident.security_compromise = map_security_incident_item_to_security_compromise(security_incident_item)
    reference_item = veris_item.get('reference')
    source_id_item = veris_item.get('source_id')
    if source_id_item or reference_item:
        add_information_source_items(reference_item, source_id_item, schema_version_item, incident)
    summary_item = veris_item.get('summary')
    if summary_item:
        incident.title = summary_item
    #targeted_item = veris_item.get('targeted')
    #if targeted_item:   
    timeline_item = veris_item.get('timeline')
    if not timeline_item:
        error("The 'timeline' item is required")
    else:
        add_timeline_item(timeline_item, incident)
#.........这里部分代码省略.........