stixproject / openioc-to-stix Goto Github PK

View Code? Open in Web Editor NEW

87.0 31.0 40.0 217 KB

Generate STIX XML from OpenIOC XML

License: BSD 3-Clause "New" or "Revised" License

Python 99.63% Shell 0.37%

openioc-to-stix's Introduction

openioc-to-stix

Generates STIX Indicator Output from an OpenIOC v1.0 XML File.

Source: https://github.com/STIXProject/openioc-to-stix
Download: https://pypi.org/project/openioc-to-stix/

Overview

The openioc-to-stix script generates STIX Indicators from an OpenIOC v1.0 XML file.

Compatible with OpenIOC v1.0
Generates STIX v1.2 and CybOX v2.1 content.

Please refer to the following websites for more information about the Structured Threat Information Expression (STIX), Cyber Observable eXpression (CybOX), and OpenIOC efforts.

Requirements

Python 2.6, 2.7, 3.4, 3.5, 3.6
mixbox >= v1.0.1
python-stix >= v1.2.0.2
python-cybox >= 2.1.0.13

NOTE Version 1.0.1 of openioc-to-stix requires python-stix < 1.2.0.0, python-cybox 2.1.0.12, and does not require mixbox.

Installation

Extract included files into your directory of choice. Please refer to the requirements.txt file for dependencies.

Install dependencies with pip:

$ pip install -r requirements.txt

You can also install openioc-to-stix into your site-packages and PATH by using `pip`:

$ cd /path/to/cloned/openioc-to-stix/repo/
$ pip install .

Usage

There are two main command line parameters for this script:

-i: the path to the input OpenIOC XML file
-o: the path to the output STIX XML file

To use the script, run the following command:

$ python openioc-to-stix.py -i <OpenIOC XML file> -o <STIX XML file>

Unsupported indicator items or those that error out during translation will be translated into an empty Observable with a description of the error in order to retain structural consistency between the input OpenIOC document and output STIX document.

Package Contents

README: This file.
openioc-to-stix.py: OpenIOC XML to STIX XML Python script.
openioc-to-cybox.py: OpenIOC XML to CybOX XML Python converter script which this script wraps.
openioc2stix/: Top-level API package.
LICENSE.txt: Terms of use for this script.
examples/*.xml: Sample input and output XML files.

TERMS

BY USING OPENIOC-TO-STIX YOU SIGNIFY YOUR ACCEPTANCE OF THE TERMS AND CONDITIONS OF USE. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT USE OPENIOC-TO-STIX.

For more information, please refer to the LICENSE.txt file

openioc-to-stix's People

Contributors

Stargazers

Watchers

openioc-to-stix's Issues

NameSpace Issue

Hello,

The script as is does not work (both openioc-to-stix and openioc-to-cybox), they return the following error:
Traceback (most recent call last):
File "openioc-to-stix.py", line 106, in
main()
File "openioc-to-stix.py", line 85, in main
stix.utils.set_id_namespace(ns)
AttributeError: 'module' object has no attribute 'set_id_namespace'

If you fix the namespace error, you then get the following error:

TypeError: Indicators must be a <class 'stix.core.Indicators'>, not a <type 'list'>

Parser does not handle DNS items correctly

While attempting to parse https://raw.githubusercontent.com/fireeye/iocs/master/FIN4/fb0699e2-23a6-40f9-bf96-4514d629eec3.ioc

I receive a traceback stack of

Traceback (most recent call last):
  File "openioc_to_stix.py", line 55, in main
    observables_cls = Observables.from_obj(observables_obj)
  File "/usr/local/lib/python2.7/dist-packages/cybox/core/observable.py", line 326, in from_obj
    obs.add(Observable.from_obj(o))
  File "/usr/local/lib/python2.7/dist-packages/cybox/core/observable.py", line 214, in from_obj
    obs.observable_composition = ObservableComposition.from_obj(observable_obj.Observable_Composition)
  File "/usr/local/lib/python2.7/dist-packages/cybox/core/observable.py", line 411, in from_obj
    obs_comp.add(Observable.from_obj(o))
  File "/usr/local/lib/python2.7/dist-packages/cybox/core/observable.py", line 212, in from_obj
    obs.object_ = Object.from_obj(observable_obj.Object)
  File "/usr/local/lib/python2.7/dist-packages/cybox/core/object.py", line 130, in from_obj
    obj.properties = ObjectProperties.from_obj(object_obj.Properties)
  File "/usr/local/lib/python2.7/dist-packages/cybox/common/object_properties.py", line 158, in from_obj
    defobj = klass.from_obj(defobj_obj)
  File "/usr/local/lib/python2.7/dist-packages/cybox/common/object_properties.py", line 145, in from_obj
    return super(ObjectProperties, cls()).from_obj(defobj_obj)
  File "/usr/local/lib/python2.7/dist-packages/cybox/__init__.py", line 189, in from_obj
    val = getattr(cls_obj, field.name)
AttributeError: 'DNSRecordObjectType' object has no attribute 'DNS_Cache_Entry'

regards
Alec

Update to use python-cybox APIs

Currently the OpenIOC -> CybOX translation code uses the python-cybox bindings rather than its APIs. We should update this to natively use the APIs, which should also fix some issues with IDs not being automatically generated, etc.

stix to openIOC ?

Wondering if the opposite is possible ?

Add Implementation for ServiceItem/descriptiveName

It looks like ServiceItem/descriptiveName maps to the Display_Name inside of the Windows Service Object, yet we currently mark it as unsupported. We should fix this and support for it.

Publish to the Python Package Server

Would be nice if this was published to the python package server.

Fix Range Handling in IndicatorItems

OpenIOC to STIX/OpenIOC to CybOX doesn't seem to translation of range-based indicators properly, like in the following example:

          <IndicatorItem id="4a52cb2b-9c78-4ac0-8b97-cc054a54a3f0" condition="is">
            <Context document="FileItem" search="FileItem/SizeInBytes" type="mir" />
            <Content type="int">145900 TO 146000</Content>
          </IndicatorItem>

We should look into this and fix it.

[From STIXProject/Tools#21]