This release is a pre-release and may not be stable for production use.
Join us on Slack!
Click here and fill out the form to receive an invite to the Open Cybersecurity Alliance slack instance, then join the #stix-shifter channel, to meet and discuss usage with the team.
Introduction Webinar!
Click here to view an introduction webinar on STIX Shifter and the use cases it solves for.
Introduction
STIX-shifter is an open source python library allowing software to connect to products that house data repositories by using STIX Patterning, and return results as STIX Observations.
For more information about this project, see the STIX-shifter Overview
Dependencies
This stix-shifter has the following dependencies:
- stix2-patterns==1.3.0
- stix2-validator==1.1.2
- stix2-matcher==1.0.0
- antlr4-python3-runtime==4.8
- python-dateutil==2.8.1
Your development environment must use Python version: 3.6, 3.7, 3.8 or 3.9
Installation
The recommended method for installing the STIX-shifter is via pip. Two prerequisite packages needs to be installed inlcuding the package of stix-shifter connector module to complete a stix-shifter connector installation. Run below commands to install all the packages-
-
Main stix-shifter package:
pip install stix-shifter -
Stix-shifter Utility package:
pip install stix-shifter-utils -
Desired stix-shifter connector module package:
pip install stix-shifter-modules-<module name>Example:pip install stix-shifter-modules-qradar
Usage
As A Command Line Utility
The STIX-Shifter comes with a bundled script which you can use to translate STIX Pattern to a native datasource query. It can also be used to translate a JSON data source query result to a STIX bundle of observable objects. You can also send query to a datasource by using a transmission option.
More details of the command line option can be found here
$ stix-shifter translate <MODULE NAME> query "<STIX IDENTITY OBJECT>" "<STIX PATTERN>" "<OPTIONS>"
Example:
$ stix-shifter translate qradar query {} "[ipv4-addr:value = '127.0.0.1']" {}
In order to build stix-shifter packages from source follow the below prerequisite steps:
- Go to the stix-shifter parent directory
- Optionally, you can create a Python 3 virtual environemnt:
virtualenv -p python3 virtualenv && source virtualenv/bin/activate - Run setup:
python3 setup.py install
Running From the Source
You may also use python3 main.py script. All the options are the same as "As a command line utility" usage above.
Example:
python3 main.py translate qradar query {} "[ipv4-addr:value = '127.0.0.1']" {}
In order to run python3 main.py from the source follow the below prerequisite steps:
- Go to the stix-shifter parent directory
- Optionally, you can create a Python 3 virtual environemnt:
virtualenv -p python3 virtualenv && source virtualenv/bin/activate - Run setup to install dependancies:
INSTALL_REQUIREMENTS_ONLY=1 python3 setup.py install.
Note: setup.py only installs dependencies when INSTALL_REQUIREMENTS_ONLY=1 directive is used. This option is similar to python3 generate_requirements.py && pip install -r requirements.txt
As A Library
You can also use this library to integrate STIX Shifter into your own tools. You can translate a STIX Pattern:
from stix_shifter.stix_translation import stix_translation
translation = stix_translation.StixTranslation()
response = translation.translate('<MODULE NAME>', 'query', '{}', '<STIX PATTERN>', '<OPTIONS>')
print(response)
Contributing
We are thrilled you are considering contributing! We welcome all contributors.
Please read our guidelines for contributing.
Guide for creating new connectors
If you want to create a new connector for STIX-shifter, see the developer guide
Licensing
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
More Resources
3 maintainers
Release files for stix-shifter-modules-proofpoint 4.0.1.dev654
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| stix_shifter_modules_proofpoint-4.0.1.dev654-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details |
Release files / stix_shifter_modules_proofpoint-4.0.1.dev654-py2.py3-none-any.whl
| Download URL | stix_shifter_modules_proofpoint-4.0.1.dev654-py2.py3-none-any.whl |
|---|---|
| Size | 37.0 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
615fa3a300c058fdb16bbdf48c0acb2dcc13ee069608ed14f7428ac29eff51cf
|
|
BLAKE2b-256 checksum How to use checksums |
333ca3074a6c632781e4872164afaa4ba3c1f4ed88767aa86ed8035aa3c10931
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.1 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.5
|
