stixmarx
A Python API for marking STIX data.
- Source:
- Documentation:
- Information:
Data Markings Concept
Learn more about the Data Markings concept here.
Examples
The following examples demonstrate the intended use of the stixmarx library.
Adding Markings
# stixmarx imports
import stixmarx
# python-stix imports
from stix.indicator import Indicator
from stix.data_marking import MarkingSpecification
from stix.extensions.marking.tlp import TLPMarkingStructure as TLP
# Create a new stixmarx MarkingContainer with a
# new STIXPackage object contained within it.
container = stixmarx.new()
# Get the associated STIX Package
package = container.package
# Create an Indicator object
indicator = Indicator(title='Indicator Title', description='Gonna Mark This')
# Add the Indicator object to our STIX Package
package.add(indicator)
# Build MarkingSpecification and add TLP MarkingStructure
red_marking = MarkingSpecification(marking_structures=TLP(color="RED"))
amber_marking = MarkingSpecification(marking_structures=TLP(color="AMBER"))
green_marking = MarkingSpecification(marking_structures=TLP(color="GREEN"))
# Mark the indicator with our TLP RED marking
# This is the equivalent of a component marking. Applies to all descendants
# nodes, text and attributes.
container.add_marking(indicator, red_marking, descendants=True)
# Mark the indicator with TLP GREEN. If descendants is false, the marking
# will only apply to the indicator node. Does NOT include text, attributes
# or descendants.
container.add_marking(indicator, green_marking)
# Mark the description text.
# >>> type(indicator.description.value) <type 'str'>
indicator.description.value = container.add_marking(indicator.description.value, amber_marking)
# >>> type(indicator.description.value) <class 'stixmarx.api.types.MarkableBytes'>
# Mark the indicator timestamp attribute.
# >>> type(indicator.timestamp) <type 'datetime.datetime'>
indicator.timestamp = container.add_marking(indicator.timestamp, amber_marking)
# >>> type(indicator.timestamp) <type 'stixmarx.api.types.MarkableDateTime'>
# Print the XML!
print container.to_xml()Retrieving Markings
# stixmarx
import stixmarx
# Parse the input into a MarkingContainer
container = stixmarx.parse("stix-document.xml")
# Get container package
package = container.package
# Get the markings that apply to the entire XML document
global_markings = container.get_markings(package)
# Print the dictionary representation for our only global marking
marking = global_markings[0]
print marking.to_dict()
# Get our only indicator from the STIX Package
indicator = package.indicators[0]
# Get the markings from the Indicator.
# Note: This will include the global markings and any other markings
# applied by an ancestor!
indicator_markings = container.get_markings(indicator)
# Print the Indicator markings!
for marking in indicator_markings:
print marking.to_dict()Notice
This software was produced for the U. S. Government, and is subject to the Rights in Data-General Clause 52.227-14, Alt. IV (DEC 2007).
Copyright (c) 2017, The MITRE Corporation. All Rights Reserved.
Release files for stixmarx 1.0.8
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| stixmarx-1.0.8.tar.gz | 27.7 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| stixmarx-1.0.8-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details |
Total release size: 59.9 kB
Release files / stixmarx-1.0.8.tar.gz
| Download URL | stixmarx-1.0.8.tar.gz |
|---|---|
| Size | 27.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f2a5855bb8a788c578cae8ecb0371a869030ec5ee3fb6f879eff7a3a0b85f075
|
|
BLAKE2b-256 checksum How to use checksums |
1820746954e0fd7bb01be6d3669e1af5933fc6406a9a7398f0093aae9845630c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.15.0 pkginfo/1.4.2 requests/2.20.1 setuptools/44.1.0 requests-toolbelt/0.8.0 tqdm/4.28.1 CPython/2.7.18
|
Release files / stixmarx-1.0.8-py2.py3-none-any.whl
| Download URL | stixmarx-1.0.8-py2.py3-none-any.whl |
|---|---|
| Size | 32.3 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
6f506aee25a921fe7cd073d20787c4cdca305debbe72fc2cbd0169ca6c894d11
|
|
BLAKE2b-256 checksum How to use checksums |
ba67ca70fbceeb4e0dbece631ebd10fd919d3da77ca68efd95b53d53a85e2fee
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.15.0 pkginfo/1.4.2 requests/2.20.1 setuptools/44.1.0 requests-toolbelt/0.8.0 tqdm/4.28.1 CPython/2.7.18
|
Security for stixmarx 1.0.8
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
