Firepit - STIX Columnar Storage

https://img.shields.io/pypi/v/firepit.svg Documentation Status Unit Test Status https://codecov.io/gh/opencybersecurityalliance/firepit/branch/develop/graph/badge.svg?token=Pu7pkqmE5W

Columnar storage for STIX 2.0 observations.

Features

  • Transforms STIX Observation SDOs to a columnar format

  • Inserts those transformed observations into SQL (currently sqlite3 and PostgreSQL)

Motivation

STIX 2.0 JSON is a graph-like data format. There aren’t many popular tools for working with graph-like data, but there are numerous tools for working with data from SQL databases. Firepit attempts to make those tools usable with STIX data obtained from stix-shifter.

Firepit also supports STIX 2.1

Firepit is primarily designed for use with the Kestrel Threat Hunting Language.

Credits

This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.

History

2.3.0 (2022-06-15)

  • Added query.BinnedColumn so you can group by time buckets

2.2.0 (2022-06-08)

  • Better STIX extension property support - Add a new __columns “private” table to store mapping from object path to column name - New path/prop metadata functions to supply metadata about STIX properties

  • Improved STIX process “deterministic” id generation - Use a unique ID from extension properties, if found - Use related x-oca-asset hostname or ID if available

2.1.0 (2022-05-18)

  • Add splint convert command to convert some logs files to STIX bundles

2.0.0 (2022-04-01)

  • Use a “normalized” SQL database

  • Initial STIX 2.1 support

1.3.0 (2021-10-04)

New assign_query API, minor query API improvements

  • new way to create views via assign_query

  • can now init a Query with a list instead of calling append

  • Some SQL injection protection in query classes

1.2.0 (2021-08-18)

  • Better support for grouped data

1.1.0 (2021-07-18)

  • First stable release

  • Concurrency fixes in cache()

1.0.0 (2021-05-18)

  • First release on PyPI.

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

2 maintainers

PyPI data
Data sourced directly from PyPI's database.
Avatar for pcoccoli from gravatar.com pcoccoli Avatar for subbyte from gravatar.com subbyte

Credits

Author: IBM Security

License

Apache Software License (Apache Software License 2.0)

Requires

Python >=3.8

Tags

stix stix-shifter sql python

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

firepit-2.3.35.tar.gz (287.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

firepit-2.3.35-py2.py3-none-any.whl (92.5 kB view details)

Uploaded Python 2Python 3

File details

Details for the file firepit-2.3.35.tar.gz.

File metadata

  • Download URL: firepit-2.3.35.tar.gz
  • Upload date:
  • Size: 287.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.4.1 importlib_metadata/7.0.1 pkginfo/1.7.0 requests/2.31.0 requests-toolbelt/0.10.1 tqdm/4.61.1 CPython/3.9.2

File hashes

Hashes for firepit-2.3.35.tar.gz
Algorithm Hash digest
SHA256 ba47f38b1b3f0d549355affe88752d3cdcb4c4e18d3cd0d23348112037024643
MD5 a35cc703eeb6d45e050ff1f746102d95
BLAKE2b-256 051c1c6a8df409d81d516a21f29a2d9195caf3839207b1b6ede2e1f3ede5b3c8

See more details on using hashes here.

File details

Details for the file firepit-2.3.35-py2.py3-none-any.whl.

File metadata

  • Download URL: firepit-2.3.35-py2.py3-none-any.whl
  • Upload date:
  • Size: 92.5 kB
  • Tags: Python 2, Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.4.1 importlib_metadata/7.0.1 pkginfo/1.7.0 requests/2.31.0 requests-toolbelt/0.10.1 tqdm/4.61.1 CPython/3.9.2

File hashes

Hashes for firepit-2.3.35-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 3d21717b7af6ba57e43c9776be04d9a52da021d3e015c2ccef41c97e506f96a9
MD5 faa809826c11e2cc7c1be976fbe05be7
BLAKE2b-256 488cfecef665bdcc093ff779df3e6846bd34f6bead3749f0922b9fd78e819353

See more details on using hashes here.

Release history Release notifications | RSS feed

This release

2.3.35

2.3.34

2.3.33

2.3.32

2.3.31

2.3.30

2.3.29

2.3.28

2.3.27

2.3.26

2.3.25

2.3.24

2.3.23

2.3.22

2.3.21

2.3.20

2.3.19

2.3.18

2.3.17

2.3.16

2.3.15

2.3.14

2.3.13

2.3.12

2.3.11

2.3.10

2.3.9

2.3.8

2.3.7

2.3.6

2.3.5

2.3.4

2.3.3

2.3.2

2.3.1

2.3.0

2.2.0

2.1.3

2.1.2

2.1.1

2.1.0

2.0.3

2.0.2

2.0.1

2.0.0

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.3

1.2.2

1.2.1

1.2.0

1.1.2

1.1.1

1.1.0

1.0.18

1.0.17

1.0.16

1.0.15

1.0.14

1.0.13

1.0.12

1.0.11

1.0.10

1.0.9

1.0.8

1.0.7

1.0.6

1.0.4

1.0.3

1.0.2

1.0.1

1.0.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page