stix-shifter-modules-elastic
pypi i stix-shifter-modules-elastic

stix-shifter-modules-elastic

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

by opencybersecurityalliance

3.1.8 (see all)
pypi i stix-shifter-modules-elastic
Readme

Join us on Slack!

Click here and fill out the form to receive an invite to the Open Cybersecurity Alliance slack instance, then join the #stix-shifter channel, to meet and discuss usage with the team.

Introduction Webinar!

Click here to view an introduction webinar on STIX Shifter and the use cases it solves for.

Introduction

STIX-shifter is an open source python library allowing software to connect to products that house data repositories by using STIX Patterning, and return results as STIX Observations.

For more information about this project, see the STIX-shifter Overview

Dependencies

This stix-shifter has the following dependencies:

Your development environment must use Python 3.6.x

Installation

The recommended method for installing the STIX-shifter is via pip.

pip install stix-shifter

Usage

As A Script

The STIX-Shifter comes with a bundled script which you can use to translate STIX Pattern to a native datasource query. It can also be used to translate a JSON data source query result to a STIX bundle of observable objects. You can also send query to a datasource by using a transmission option.

More details of the command line option can be found here

$ stix-shifter translate <MODULE NAME> query "<STIX IDENTITY OBJECT>" "<STIX PATTERN>" "<OPTIONS>"

Example:

$ stix-shifter translate qradar query {} "[ipv4-addr:value = '127.0.0.1']" {}

Note: In order to create python executable stix-shifter from source run the following command from stix-shifter parent directory in your python 3 environment: python setup.py install

As A Library

You can also use this library to integrate STIX Shifter into your own tools. You can translate a STIX Pattern:

from stix_shifter.stix_translation import stix_translation

translation = stix_translation.StixTranslation()
response = translation.translate('<MODULE NAME>', 'query', '{}', '<STIX PATTERN>', '<OPTIONS>')

print(response)

Contributing

We are thrilled you are considering contributing! We welcome all contributors.

Please read our guidelines for contributing.

Guide for creating new connectors

If you want to create a new connector for STIX-shifter, see the developer guide

Licensing

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

GitHub Stars

160

LAST COMMIT

5mos ago

MAINTAINERS

1

CONTRIBUTORS

83

OPEN ISSUES

31

OPEN PRs

17
VersionTagPublished
3.1.8
2yrs ago
3.1.7
2yrs ago
3.1.5
2yrs ago
3.1.4
2yrs ago
No alternatives found
No tutorials found
Add a tutorial