stixmarx

A Python API for marking STIX data.

Source:: https://github.com/mitre/stixmarx/
Documentation:: https://stixmarx.readthedocs.org/
Information:: https://stixproject.github.io/

Data Markings Concept

Learn more about the Data Markings concept here.

Examples

The following examples demonstrate the intended use of the stixmarx library.

Adding Markings

# stixmarx imports
import stixmarx

# python-stix imports
from stix.indicator import Indicator
from stix.data_marking import MarkingSpecification
from stix.extensions.marking.tlp import TLPMarkingStructure as TLP


# Create a new stixmarx MarkingContainer with a
# new STIXPackage object contained within it.
container = stixmarx.new()

# Get the associated STIX Package
package = container.package

# Create an Indicator object
indicator = Indicator(title='Indicator Title', description='Gonna Mark This')

# Add the Indicator object to our STIX Package
package.add(indicator)

# Build MarkingSpecification and add TLP MarkingStructure
red_marking = MarkingSpecification(marking_structures=TLP(color="RED"))
amber_marking = MarkingSpecification(marking_structures=TLP(color="AMBER"))
green_marking = MarkingSpecification(marking_structures=TLP(color="GREEN"))


# Mark the indicator with our TLP RED marking
# This is the equivalent of a component marking. Applies to all descendants
# nodes, text and attributes.
container.add_marking(indicator, red_marking, descendants=True)


# Mark the indicator with TLP GREEN. If descendants is false, the marking
# will only apply to the indicator node. Does NOT include text, attributes
# or descendants.
container.add_marking(indicator, green_marking)


# Mark the description text.
# >>> type(indicator.description.value)  <type 'str'>
indicator.description.value = container.add_marking(indicator.description.value, amber_marking)
# >>> type(indicator.description.value)  <class 'stixmarx.api.types.MarkableBytes'>


# Mark the indicator timestamp attribute.
# >>> type(indicator.timestamp)  <type 'datetime.datetime'>
indicator.timestamp = container.add_marking(indicator.timestamp, amber_marking)
# >>> type(indicator.timestamp)  <type 'stixmarx.api.types.MarkableDateTime'>

# Print the XML!
print container.to_xml()

Retrieving Markings

# stixmarx
import stixmarx

# Parse the input into a MarkingContainer
container = stixmarx.parse("stix-document.xml")

# Get container package
package = container.package

# Get the markings that apply to the entire XML document
global_markings = container.get_markings(package)

# Print the dictionary representation for our only global marking
marking = global_markings[0]
print marking.to_dict()

# Get our only indicator from the STIX Package
indicator = package.indicators[0]

# Get the markings from the Indicator.
# Note: This will include the global markings and any other markings
# applied by an ancestor!
indicator_markings = container.get_markings(indicator)

# Print the Indicator markings!
for marking in indicator_markings:
    print marking.to_dict()

Notice

This software was produced for the U. S. Government, and is subject to the Rights in Data-General Clause 52.227-14, Alt. IV (DEC 2007).

Release files for stixmarx 1.0.8

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for stixmarx 1.0.8
File	Size	Uploaded
stixmarx-1.0.8.tar.gz	27.7 kB	Nov 18, 2020	Details

Built distribution (wheel)

Table of built distributions (wheels) for stixmarx 1.0.8
File	Interpreter	ABI	Platform	Reset
stixmarx-1.0.8-py2.py3-none-any.whl 32.3 kB Nov 18, 2020	Python 3, Python 2	none	any	Details

Total release size: 59.9 kB

Release files / stixmarx-1.0.8.tar.gz

Download URL	stixmarx-1.0.8.tar.gz
Size	27.7 kB
Tags	Source
SHA-256 checksum How to use checksums	`f2a5855bb8a788c578cae8ecb0371a869030ec5ee3fb6f879eff7a3a0b85f075`
BLAKE2b-256 checksum How to use checksums	`1820746954e0fd7bb01be6d3669e1af5933fc6406a9a7398f0093aae9845630c`
Upload date	Nov 18, 2020
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.15.0 pkginfo/1.4.2 requests/2.20.1 setuptools/44.1.0 requests-toolbelt/0.8.0 tqdm/4.28.1 CPython/2.7.18`

Release files / stixmarx-1.0.8-py2.py3-none-any.whl

Download URL	stixmarx-1.0.8-py2.py3-none-any.whl
Size	32.3 kB
Tags	Python 2 Python 3
SHA-256 checksum How to use checksums	`6f506aee25a921fe7cd073d20787c4cdca305debbe72fc2cbd0169ca6c894d11`
BLAKE2b-256 checksum How to use checksums	`ba67ca70fbceeb4e0dbece631ebd10fd919d3da77ca68efd95b53d53a85e2fee`
Upload date	Nov 18, 2020
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/1.15.0 pkginfo/1.4.2 requests/2.20.1 setuptools/44.1.0 requests-toolbelt/0.8.0 tqdm/4.28.1 CPython/2.7.18`