search

oasis-open / cti-stix-elevator

OASIS Cyber Threat Intelligence (CTI) TC Open Repository: Convert STIX 1.2 XML to STIX 2.x JSON
https://stix2-elevator.readthedocs.io/en/latest/
BSD 3-Clause "New" or "Revised" License
49 stars 23 forks source link

converts STIX2.0 to 2.1 #256

Closed lizitong67 closed 3 years ago

lizitong67 commented 3 years ago

How to convert my CTI expressed in STIX 2.0 to STIX 2.1?

clenk commented 3 years ago

After installing the elevator, you can use the stepper as described here.

lizitong67 commented 3 years ago

thx, but when I run this in a stix 2.0 JSON file, I encountered a waining in begin of the output JSON and two warnings at the end of the output JSON, what's wrong?

[stixmarx.utils] [WARNING] [2021-03-31 12:08:05,954] No module named 'maec'
{
    The output JSON
}
================================================================================
[-] Results for: enterprise-attack/malware/malware--007b44b6-e4c5-480b-b5b9-56f2081b1b7b.json
[+] STIX JSON: Valid
    [!] Warning: malware--007b44b6-e4c5-480b-b5b9-56f2081b1b7b: {216} malware_types contains a value not in the malware-type-ov vocabulary.
    [!] Warning: malware--007b44b6-e4c5-480b-b5b9-56f2081b1b7b: {302} External reference 'mitre-attack' has a URL but no hash.
rpiazza commented 3 years ago

Hi @lizitong67,

Use pip to download the maec python package. That should get rid of the first warning.

The other warnings are from the stix validator. The generated JSON is valid, but the warnings mean you are doing something that the STIX specification recommends against. See https://docs.oasis-open.org/cti/stix/v2.1/cs02/stix-v2.1-cs02.html