ioc_writer

API providing a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise.

Showing:

Popularity

Downloads/wk

0

GitHub Stars

175

Maintenance

Last Commit

4yrs ago

Contributors

7

Package

Dependencies

0

License

UNKNOWN

Categories

Readme

ioc_writer

The source code in this package is made available under the terms of the Apache License , Version 2.0. See the "LICENSE " file for more information.

Status

  • Build Status
  • Coverage Status

Author

William Gibb william.gibb at fireeye dot com

Purpose

Provide a python library that allows for basic creation and editing of OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete) for various items:

itemCreateReadUpdateDelete
IOC nameYesNoYesYes
IOC descriptionYesNoYesYes
created dateYesNoYesN/A
last modified dateYesNoYesN/A
published dateYesNoYesN/A
link metadataYesNoYesYes
IndicatorItem nodesYesNoNotYetYes
Indicator nodesYesNoNotYetYes
ParametersYesNoYesYes

Items do not have built in Read operations, since all items can be accesed with built in ElementTree syntax or the use of XPATH to select portions of the IOC.

No decision has been made about whether or not to support changing of existing Indicator/IndicatorItem nodes.

See the Docs located at https://pythonhosted.org/ioc_writer/ and the examples directory for examples of working with the library. The user code should avoid having to call functionality in ioc_writer.ioc_et.

Requirements

The python "lxml" library must be installed. This can be obtained from https://pypi.python.org/pypi/lxml

Installation

See the file named "INSTALL" for instructions on installing this library locally.

Examples

Example code lives in the examples folder of the repository.

  1. examples/11_to_10_downgrade Script to downgrade OpenIOC 1.1 to OpenIOC 1.1.
  2. examples/openioc_to_yara Scripts that support encapsulating YARA signatures in OpenIOC 1.1 format.
  3. examples/simple_ioc_writer Script that consumes a csv of data to build an IOC. this csv contains the content, context, et cetera. An example CSV is provided.

Bug reports / questions / feedback / feature requests

william.gibb at fireeye dot com

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100
No reviews found
Be the first to rate

Alternatives

No alternatives found

Tutorials

No tutorials found
Add a tutorial