Closed c52-k closed 4 years ago
Hi @c52-k, printing the pattern_expr
gives me
[{
"type": "network-traffic",
"src_ref": "0",
"dst_ref": "1",
"protocols": [
"ipv4",
"udp"
]
}]
which is not a valid STIX pattern. We could modify the library to not allow this to be created, but in the meantime, the observation expression should contain some kind of comparison expression in it like the examples in the docs. For example, you could do the following to make a pattern match on just the src_addr:
lhs = stix2.ObjectPath("network-traffic", ["src_ref", "value"])
pattern_expr2 = stix2.ObservationExpression(stix2.EqualityComparisonExpression(lhs, src_addr_s.value))
giving you a pattern of
[network-traffic:src_ref.value = '192.168.0.76']
Or, if you wanted to match on all of the properties in the network-traffic
object:
lhs_src = stix2.ObjectPath("network-traffic", ["src_ref", "value"])
lhs_dst = stix2.ObjectPath("network-traffic", ["dst_ref", "value"])
lhs_proto = stix2.ObjectPath("network-traffic", ["protocols"])
eq_src = stix2.EqualityComparisonExpression(lhs_src, src_addr_s.value)
eq_dst = stix2.EqualityComparisonExpression(lhs_dst, dst_addr_s.value)
eq_proto = stix2.EqualityComparisonExpression(lhs_proto, ['ipv4', 'udp'])
and1 = stix2.AndBooleanExpression([eq_src, eq_dst])
and2 = stix2.AndBooleanExpression([and1, eq_proto])
pattern_expr3 = stix2.ObservationExpression(and2)
giving you
[network-traffic:src_ref.value = '192.168.0.76' AND network-traffic:dst_ref.value = '192.168.0.54' AND network-traffic:protocols IN ('ipv4', 'udp')]
Thanks for the clarification! I understand the concept now. You have to construct the pattern based on properties that needs to be matched when matching 2 indicators.
Closing this as it seems this addressed the problem, but feel free to open another issue if you run into any other problems.
Hello,
I get the following error when trying to create an indicator with a NetworkTraffic pattern in STIX 2.0.
stix2.exceptions.InvalidValueError: Invalid value for Indicator 'pattern': FAIL: Error found at line 1:1. mismatched input '{' expecting {IdentifierWithoutHyphen, IdentifierWithHyphen, '('}
I'm first creating a NetworkTraffic object and converting it into a ObservationExpression as explained in https://stix2.readthedocs.io/en/latest/guide/patterns.html.
Following is the code I am using, to create the pattern and the indicator.
I have to use STIX 2 .0 for this due to some old dependencies (not STIX 2.1). Any help on this is appreciated.
Thank you!