stix2-slider 4.0.1

Utilities to downgrade STIX 2.1 content to STIX 1.X and CyBOX 2.1

cti-stix-slider

NOTE: This is an OASIS TC Open Repository. See the Governance section for more information.

The stix-slider is a software tool for ‘sliding’ STIX 2.x JSON to STIX 1.x XML. Due to the differences between STIX 1.x and STIX 2.x, this conversion is best-effort only. During the conversion, stix-slider provides information on the assumptions it needs to make to produce valid STIX 1.x XML, and what information was not able to be converted.

The stix-slider is a work-in-progress. It should be used to explore how STIX 2.x content could potentially be represented in STIX 1.x. Using the current version of the slider will provide insight to issues that might need to be mitigated to convert your STIX 2.x content for use in application that accept only STIX 1.x content.

It should not be used in a production environment, and should not be considered final.

Please enter any comments on how to improve it into the issue tracker.

For more information, see the documentation on ReadTheDocs.

Requirements

• Python 3.8+

• python-stix and its dependencies

  Note

  Make sure to use either the latest version of python-stix 1.1.1.x or 1.2.0.x, depending on whether you want to support STIX 1.1.1 or STIX 1.2.

• python-stix2 >= 3.0.0

• stixmarx >= 1.0.8

• stix-validator >= 3.0.0

Installation

Install with pip:

$ pip install stix2-slider

This will install all necessary dependencies, including the latest version of python-stix.

If you need to support older STIX 1.1.1 content, install python-stix 1.1.1.x first:

$ pip install 'stix<1.2'
$ pip install stix2-slider

You can also install the stix-slider from GitHub to get the latest (unstable) version:

$ pip install git+https://github.com/oasis-open/cti-stix-slider.git

Usage

It is recommended that you ensure that the input STIX 2.x file is valid before submitting it to the slider. Use the stix2-validator.

As A Script

The slider comes with a bundled script which you can use to convert STIX 2.x content to STIX 1.x content:

usage: stix2_slider [-h] [--no-squirrel-gaps] [--validator-args VALIDATOR_ARGS]
                    [-e ENABLE] [-d DISABLE] [-s]
                    [--message-log-directory MESSAGE_LOG_DIRECTORY]
                    [--log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}]
                    [--use-namespace USE_NAMESPACE]
                    file

stix2-slider v4.0.1

The stix2-slider is a work-in-progress. It should be used to explore how
existing STIX 2.x would potentially be represented in STIX 1.x. Using the
current version of the stix2-slider will provide insight to issues that might need
to be mitigated so you can use an application that supports only STIX 1.x content.

positional arguments:   The input STIX 2.x document to be 'slid' to STIX 1.x..

optional arguments:
  -h, --help            show this help message and exit

  --no-squirrel-gaps    Do not include STIX 2.x content that cannot be
                        represented directly in STIX 1.x using the description
                        property.

  --validator-args VALIDATOR_ARGS
                        Arguments to pass to stix-validator. Example:
                        stix2_slider <file> --validator-args="--best-
                        practices"

  -e ENABLE, --enable ENABLE
                        A comma-separated list of the stix2-slider messages to
                        enable. If the --disable option is not used, no other
                        messages will be shown. Example: stix2_slider <file>
                        --enable 250

  -d DISABLE, --disable DISABLE
                        A comma-separated list of the stix2-slider messages to
                        disable. Example: stix2_slider <file> --disable
                        212,220

  -s, --silent          If this flag is set. All stix2-slider messages will be
                        disabled.

  --message-log-directory MESSAGE_LOG_DIRECTORY
                        If this flag is set, all stix2-slider messages will be
                        saved to file. The name of the file will be the input
                        file with extension .log in the specified directory.
                        Note, make sure the directory already exists. Example:
                        stix2_slider <file> --message-log-directory "../logs"

  --log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}
                        The logging output level.

  --use-namespace USE_NAMESPACE
                        Override the 'example' namespace with the provided one.
                        The format is the prefix, namespace uri and optionally
                        the schema location separated by a space. Example:
                        stix2_slider <file> --use-namespace="example
                        http://example.com"

Refer to slider_log_messages.rst for all stix2-slider messages. Use the associated code number
to --enable or --disable a message. By default, the stix2-slider displays all
messages. Note: disabling the message does not disable the functionality.

As A Library

You can also use this library to integrate STIX ‘sliding’ into your own tools. You can slide a STIX 2.x file:

from stix2slider import slide_file
from stix2slider.options import initialize_options

initialize_options()
results = slide_file("stix_file.json")
print(results)

Additionally, a similar method exists to accept a string as an argument:

from stix2slider import slide_string
from stix2slider.options import initialize_options

initialize_options()
results = slide_string("...")
print(results)

To set options, use set_option_value, found in options.py.

Governance

This GitHub public repository ( https://github.com/oasis-open/cti-stix-slider ) was was created at the request of the the OASIS Cyber Threat Intelligence (CTI) TC as an OASIS TC Open Repository to support development of open source resources related to Technical Committee work.

While this TC Open Repository remains associated with the sponsor TC, its development priorities, leadership, intellectual property terms, participation rules, and other matters of governance are separate and distinct from the OASIS TC Process and related policies.

All contributions made to this TC Open Repository are subject to open source license terms expressed in the BSD-3-Clause License. That license was selected as the declared “Applicable License” when the TC Open Repository was created.

As documented in “Public Participation Invited”, contributions to this OASIS TC Open Repository are invited from all parties, whether affiliated with OASIS or not. Participants must have a GitHub account, but no fees or OASIS membership obligations are required. Participation is expected to be consistent with the OASIS TC Open Repository Guidelines and Procedures, the open source LICENSE designated for this particular repository, and the requirement for an Individual Contributor License Agreement that governs intellectual property.

Statement of Purpose

Statement of Purpose for this OASIS TC Open Repository (cti-stix- slider) as proposed and approved [bis] by the TC:

This GitHub public repository is provided to support version- controlled development of a Python “slider” application which will convert STIX 2.x content to STIX 1.x content.

Maintainers

TC Open Repository Maintainers are responsible for oversight of this project’s community development activities, including evaluation of GitHub pull requests and preserving open source principles of openness and fairness. Maintainers are recognized and trusted experts who serve to implement community goals and consensus design preferences.

Initially, the associated TC members have designated one or more persons to serve as Maintainer(s); subsequently, participating community members may select additional or substitute Maintainers, per consensus agreements.

Current Maintainers of this TC Open Repository

• Jason Keirstead; GitHub ID: https://github.com/JasonKeirstead; WWW: Cyware Labs

About OASIS TC Open Repositories

• TC Open Repositories: Overview and Resources

• Frequently Asked Questions

• Open Source Licenses

• Contributor License Agreements (CLAs)

• Maintainers’ Guidelines and Agreement

Feedback

Questions or comments about this TC Open Repository’s activities should be composed as GitHub issues or comments. If use of an issue/comment is not possible or appropriate, questions may be directed by email to the Maintainer(s) listed above. Please send general questions about TC Open Repository participation to OASIS Staff at [e-mail] and any specific CLA-related questions to [e-mail].