Any CIS platform like CYBEX-P potentially handles hundreds of different data formats. Thus, it needs a standard data format and structure to represent threat data. Examples of threat data are email, firewall logs, malware signatures, file hashes etc. A cyberthreat language (CTL) is a specification of how to format and serialize any kind of threat data. CYBEX-P uses TAHOE instead of other CTLs like STIX or MISP. TAHOE structures threat data as JSON documents.
This repository is a Python library that should be used to structure any threat data in TAHOE format. Find the complete TAHOE specification in /specification
. The documentation is in /docs
.
Download & install Python 3.9.x.
Create and activate Python virtual environment (official documentation). \
Create: python -m venv myenv
\
Activate in Ubuntu: source myenv/bin/activate
\
Activate in Windows: source myenv/Scripts/activate
Download the files from the TAHOE repository.
git clone https://github.com/CYBEX-P/tahoe
Install
cd tahoe
python setup.py install
Unittest
python -m unittest
A piece of TAHOE data is called an instance and there are 5 types of TAHOE instances —
Raw A data instance stores unprocessed user data.
Attribute The most basic datatype that holds a single piece of information, like an IP address.
Object Groups several attributes or other objects together, e.g., a file may have a filename attribute and a file-size attribute.
Event An event consists of one or more attributes or objects along with a timestamp. Events structure attributes or objects into complete threat data.
Session A session groups arbitrarily related events. (e.g. events when a user visits a website).
python setup.py sdist
pip install dist/tahoe
python3 -m venv sphinx-env
source sphinx-env/bin/activate
pip install -r docs/requirements.txt # doc gen requirements
python3 setup.py install # install requirements for tahoe
cd docs
# the following step might not be needed depending how it is imported
# if modules.rst and reStructuredText files are used somewhere in the source docs
#then use the following line to regenerate modules
sphinx-apidoc -f -o source/ ../tahoe # regenerate automatic file generation
make clean html
output is in docs/build/html
.
basic rst language
how to import docstring directly into current file.
generate reStructuredText files (using modules.rst)
https://medium.com/@richdayandnight/a-simple-tutorial-on-how-to-document-your-python-project-using-sphinx-and-rinohtype-177c22a15b5b
manipulating the toctree