search

oasis-open / cti-stix-slider

OASIS TC Open Repository: The repository cti-stix-slider supports development of a Python application to convert STIX 2.0 content to STIX 1.x content
https://cti-stix-slider.readthedocs.io/en/latest/
BSD 3-Clause "New" or "Revised" License
21 stars 15 forks source link
converter cti cyber-threat-intelligence json oasis python python-script stix stix2 xml

readme

|Build_Status| |Coverage| |Version|

cti-stix-slider

NOTE: This is an OASIS TC Open Repository <https://www.oasis-open.org/resources/open- repositories/>. See the Governance section for more information.

The stix-slider is a software tool for 'sliding' STIX 2.x JSON to STIX 1.x XML. Due to the differences between STIX 1.x and STIX 2.x, this conversion is best-effort only. During the conversion, stix-slider provides information on the assumptions it needs to make to produce valid STIX 1.x XML, and what information was not able to be converted.

The stix-slider is a work-in-progress. It should be used to explore how STIX 2.x content could potentially be represented in STIX 1.x. Using the current version of the slider will provide insight to issues that might need to be mitigated to convert your STIX 2.x content for use in application that accept only STIX 1.x content.

It should not be used in a production environment, and should not be considered final.

Please enter any comments on how to improve it into the issue tracker.

For more information, see the documentation <https://cti-stix-slider.readthedocs.io/>__ on ReadTheDocs.

Requirements

Installation

Install with pip::

$ pip install stix2-slider

This will install all necessary dependencies, including the latest version of python-stix.

If you need to support older STIX 1.1.1 content, install python-stix 1.1.1.x first::

$ pip install 'stix<1.2'
$ pip install stix2-slider

You can also install the stix-slider from GitHub to get the latest (unstable) version::

$ pip install git+https://github.com/oasis-open/cti-stix-slider.git

Usage

It is recommended that you ensure that the input STIX 2.x file is valid before submitting it to the slider. Use the stix2-validator <https://pypi.org/project//stix2-validator>_.

As A Script


The slider comes with a bundled script which you can use to convert
STIX 2.x content to STIX 1.x content::

        usage: stix2_slider [-h] [--no-squirrel-gaps] [--validator-args VALIDATOR_ARGS]
                            [-e ENABLE] [-d DISABLE] [-s]
                            [--message-log-directory MESSAGE_LOG_DIRECTORY]
                            [--log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}]
                            [--use-namespace USE_NAMESPACE]
                            file

        stix2-slider v4.0.1

        The stix2-slider is a work-in-progress. It should be used to explore how
        existing STIX 2.x would potentially be represented in STIX 1.x. Using the
        current version of the stix2-slider will provide insight to issues that might need
        to be mitigated so you can use an application that supports only STIX 1.x content.

        positional arguments:   The input STIX 2.x document to be 'slid' to STIX 1.x..

        optional arguments:
          -h, --help            show this help message and exit

          --no-squirrel-gaps    Do not include STIX 2.x content that cannot be
                                represented directly in STIX 1.x using the description
                                property.

          --validator-args VALIDATOR_ARGS
                                Arguments to pass to stix-validator. Example:
                                stix2_slider <file> --validator-args="--best-
                                practices"

          -e ENABLE, --enable ENABLE
                                A comma-separated list of the stix2-slider messages to
                                enable. If the --disable option is not used, no other
                                messages will be shown. Example: stix2_slider <file>
                                --enable 250

          -d DISABLE, --disable DISABLE
                                A comma-separated list of the stix2-slider messages to
                                disable. Example: stix2_slider <file> --disable
                                212,220

          -s, --silent          If this flag is set. All stix2-slider messages will be
                                disabled.

          --message-log-directory MESSAGE_LOG_DIRECTORY
                                If this flag is set, all stix2-slider messages will be
                                saved to file. The name of the file will be the input
                                file with extension .log in the specified directory.
                                Note, make sure the directory already exists. Example:
                                stix2_slider <file> --message-log-directory "../logs"

          --log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}
                                The logging output level.

          --use-namespace USE_NAMESPACE
                                Override the 'example' namespace with the provided one.
                                The format is the prefix, namespace uri and optionally
                                the schema location separated by a space. Example:
                                stix2_slider <file> --use-namespace="example
                                http://example.com"

        Refer to slider_log_messages.rst for all stix2-slider messages. Use the associated code number
        to --enable or --disable a message. By default, the stix2-slider displays all
        messages. Note: disabling the message does not disable the functionality.

As A Library

You can also use this library to integrate STIX 'sliding' into your own tools. You can slide a STIX 2.x file::

  from stix2slider import slide_file
  from stix2slider.options import initialize_options

  initialize_options()
  results = slide_file("stix_file.json")
  print(results)

Additionally, a similar method exists to accept a string as an argument::

  from stix2slider import slide_string
  from stix2slider.options import initialize_options

  initialize_options()
  results = slide_string("...")
  print(results)

To set options, use set_option_value, found in options.py.

Governance

This GitHub public repository ( https://github.com/oasis-open/cti-stix-slider ) was was created at the request of the the OASIS Cyber Threat Intelligence (CTI) TC <https://www.oasis-open.org/committees/cti/> as an OASIS TC Open Repository <https://www.oasis-open.org/resources/open- repositories/> to support development of open source resources related to Technical Committee work.

While this TC Open Repository remains associated with the sponsor TC, its development priorities, leadership, intellectual property terms, participation rules, and other matters of governance are separate and distinct <https://github.com/oasis-open/cti-stix- slider/blob/master/CONTRIBUTING.md#governance-distinct-from-oasis-tc- process>__ from the OASIS TC Process and related policies.

All contributions made to this TC Open Repository are subject to open source license terms expressed in the BSD-3-Clause License <https://www.oasis-open.org/sites/www.oasis- open.org/files/BSD-3-Clause.txt>. That license was selected as the declared "Applicable License" <https://www.oasis-open.org/resources/open- repositories/licenses> when the TC Open Repository was created.

As documented in "Public Participation Invited <https://github.com/oasis-open/cti-stix- slider/blob/master/CONTRIBUTING.md#public-participation- invited>", contributions to this OASIS TC Open Repository are invited from all parties, whether affiliated with OASIS or not. Participants must have a GitHub account, but no fees or OASIS membership obligations are required. Participation is expected to be consistent with the OASIS TC Open Repository Guidelines and Procedures <https://www.oasis-open.org/policies-guidelines/open- repositories>, the open source LICENSE <https://github.com/oasis-open/cti-stix- slider/blob/master/LICENSE> designated for this particular repository, and the requirement for an Individual Contributor License Agreement <https://www.oasis-open.org/resources/open- repositories/cla/individual-cla> that governs intellectual property.

Statement of Purpose


Statement of Purpose for this OASIS TC Open Repository (cti-stix-
slider) as `proposed <https://lists.oasis-
open.org/archives/cti/201711/msg00000.html>`_ and `approved
<https://lists.oasis-open.org/archives/cti/201711/msg00002.html>`_
`[bis] <https://issues.oasis-open.org/browse/TCADMIN-2807>`_ by the
TC:

This GitHub public repository is provided to support version-
controlled development of a Python "slider" application which will
convert `STIX 2.x <http://docs.oasis-open.org/cti/stix/v2.x/>`_
content to `STIX 1.x <http://docs.oasis-open.org/cti/stix/v1.2.1/>`_
content.

Maintainers

TC Open Repository Maintainers <https://www.oasis-open.org/resources/open- repositories/maintainers-guide> are responsible for oversight of this project's community development activities, including evaluation of GitHub pull requests <https://github.com/oasis-open/cti-stix- slider/blob/master/CONTRIBUTING.md#fork-and-pull-collaboration- model> and preserving <https://www.oasis-open.org/policies-guidelines/open- repositories#repositoryManagement>__ open source principles of openness and fairness. Maintainers are recognized and trusted experts who serve to implement community goals and consensus design preferences.

Initially, the associated TC members have designated one or more persons to serve as Maintainer(s); subsequently, participating community members may select additional or substitute Maintainers, per consensus agreements <https://www.oasis-open.org/resources/open- repositories/maintainers-guide#additionalMaintainers>__.

Current Maintainers of this TC Open Repository

About OASIS TC Open Repositories

Feedback

Questions or comments about this TC Open Repository's activities should be composed as GitHub issues or comments. If use of an issue/comment is not possible or appropriate, questions may be directed by email to the Maintainer(s) listed above <#currentMaintainers>__. Please send general questions about TC Open Repository participation to OASIS Staff at repository-admin@oasis-open.org and any specific CLA-related questions to repository-cla@oasis-open.org.

.. |Build_Status| image:: https://github.com/oasis-open/cti-stix-slider/workflows/cti-stix-slider%20test%20harness/badge.svg :target: https://github.com/oasis-open/cti-stix-slider/actions?query=workflow%3A%22cti-stix-slider+test+harness%22 .. |Coverage| image:: https://codecov.io/gh/oasis-open/cti-stix-slider/branch/master/graph/badge.svg :target: https://codecov.io/gh/oasis-open/cti-stix-slider .. |Version| image:: https://img.shields.io/pypi/v/stix2-slider.svg?maxAge=3600 :target: https://pypi.python.org/pypi/stix2-slider/