(self, package, reference='', hdr_events=False, source='',
                      use_hdr_src=False)
Parse a STIX package.

        :param package: A STIX package
        :type package: :class:`stix.core.STIXPackage`
        :param reference: The reference to the data.
        :type reference: str
        :param hdr_events: Whether to create an Event for each Package header.
        :type hdr_events: bool
        :param source: The source of this document.
        :type source: str
        :param use_hdr_src: If True, try to use the STIX Header Information
                             Source instead of the value in "source" parameter
        :type use_hdr_src: boolean
Parse a STIX package.
Parse a STIX package .
def parse_package(self, package, reference='', hdr_events=False, source='',
                      use_hdr_src=False):
        """
        Parse a STIX package.

        :param package: A STIX package
        :type package: :class:`stix.core.STIXPackage`
        :param reference: The reference to the data.
        :type reference: str
        :param hdr_events: Whether to create an Event for each Package header.
        :type hdr_events: bool
        :param source: The source of this document.
        :type source: str
        :param use_hdr_src: If True, try to use the STIX Header Information
                             Source instead of the value in "source" parameter
        :type use_hdr_src: boolean
        """

        header = package.stix_header
        if not self.preview:
            self.stix_version = package.version
            try:
                hdr_source = header.information_source.identity.name
            except:
                hdr_source = None
            try:
                hdr_ref = ", ".join(header.information_source.references)
            except:
                hdr_ref = None

            # if STIX src is preferred and valid, use it
            if use_hdr_src and hdr_ref:
                reference = hdr_ref # use STIX Header references
            if use_hdr_src and does_source_exist(hdr_source):
                self.source.name = hdr_source # use STIX header source identity
            elif does_source_exist(source): # else use given source if valid
                self.source.name = source
                if hdr_source and source != hdr_source:
                    refs = [reference, "STIX Source: %s" % hdr_source]
                    reference = ", ".join(x for x in refs if x)
            elif does_source_exist(hdr_source): # else use STIX src if valid
                self.source.name = hdr_source
            else: # else error because a valid source is required
                msg = 'No valid source provided ("%s", "%s")'
                raise STIXParserException(msg  % (source, hdr_source))

            self.source_instance.reference = reference
            self.source.instances.append(self.source_instance)

        # If hdr_events is True, add Event based on the STIX_Header,
        # unless this package came from a CRITs instance. Packages generated
        # by CRITs have limited valuable header data.
        # This event will have relationships to everything in the STIX Package
        if hdr_events:
            title = "STIX Package %s" % package.id_
            event_type = None
            event_date = datetime.datetime.now()
            description = ""
            is_from_crits = False
            if isinstance(header, STIXHeader):
                if header.title == "CRITs Generated STIX Package":
                    is_from_crits = True
                else:
                    title = header.title or title
                    if header.package_intents:
                        try:
                            intent = str(header.package_intents[0])
                            event_type = get_crits_event_type(intent)
                        except:
                            pass
                    info_src = header.information_source
                    if (info_src and info_src.time
                        and info_src.time.produced_time):
                        event_date = info_src.time.produced_time.value
                        if event_date.tzinfo:
                            event_date = event_date.astimezone(pytz.utc)
                            event_date = event_date.replace(tzinfo=None)
                    description = getattr(header.description, 'value', "")

            if self.preview and not is_from_crits:
                self.imported[package.id_] = ('Event', None, title)
            elif not is_from_crits:
                res = add_new_event(title,
                                    description,
                                    event_type or EventTypes.INTEL_SHARING,
                                    self.source.name,
                                    self.source_instance.method,
                                    self.source_instance.reference,
                                    event_date,
                                    self.source_instance.analyst)
                self.parsed.append(package.id_)
                if res['success']:
                    self.pkg_event = res['object']
                    self.imported[package.id_] = ('Event',
                                                  res['object'].id, title)
                    self.updates[res['object'].id] = res['object']
                else:
                    self.failed.append((res['message'],
                                        "Event (%s)" % title,
                                        package.id_))

        if package.indicators:
            self.parse_indicators(package.indicators)

        if package.observables and package.observables.observables:
            self.parse_observables(package.observables.observables,
                                   is_ind=self.obs_as_ind)

        if package.threat_actors:
            self.parse_threat_actors(package.threat_actors)

        if package.ttps:
            self.parse_ttps(package.ttps)

        if package.incidents:
            self.parse_incidents(package.incidents)
def parse_package ( self , package , reference = '' , hdr_events = False , source = '' , use_hdr_src = False ) : header = package . stix_header if not self . preview : self . stix_version = package . version try : hdr_source = header . information_source . identity . name except : hdr_source = None try : hdr_ref = ", " . join ( header . information_source . references ) except : hdr_ref = None # if STIX src is preferred and valid, use it if use_hdr_src and hdr_ref : reference = hdr_ref # use STIX Header references if use_hdr_src and does_source_exist ( hdr_source ) : self . source . name = hdr_source # use STIX header source identity elif does_source_exist ( source ) : # else use given source if valid self . source . name = source if hdr_source and source != hdr_source : refs = [ reference , "STIX Source: %s" % hdr_source ] reference = ", " . join ( x for x in refs if x ) elif does_source_exist ( hdr_source ) : # else use STIX src if valid self . source . name = hdr_source else : # else error because a valid source is required msg = 'No valid source provided ("%s", "%s")' raise STIXParserException ( msg % ( source , hdr_source ) ) self . source_instance . reference = reference self . source . instances . append ( self . source_instance ) # If hdr_events is True, add Event based on the STIX_Header, # unless this package came from a CRITs instance. Packages generated # by CRITs have limited valuable header data. # This event will have relationships to everything in the STIX Package if hdr_events : title = "STIX Package %s" % package . id_ event_type = None event_date = datetime . datetime . now ( ) description = "" is_from_crits = False if isinstance ( header , STIXHeader ) : if header . title == "CRITs Generated STIX Package" : is_from_crits = True else : title = header . title or title if header . package_intents : try : intent = str ( header . package_intents [ 0 ] ) event_type = get_crits_event_type ( intent ) except : pass info_src = header . information_source if ( info_src and info_src . time and info_src . time . produced_time ) : event_date = info_src . time . produced_time . value if event_date . tzinfo : event_date = event_date . astimezone ( pytz . utc ) event_date = event_date . replace ( tzinfo = None ) description = getattr ( header . description , 'value' , "" ) if self . preview and not is_from_crits : self . imported [ package . id_ ] = ( 'Event' , None , title ) elif not is_from_crits : res = add_new_event ( title , description , event_type or EventTypes . INTEL_SHARING , self . source . name , self . source_instance . method , self . source_instance . reference , event_date , self . source_instance . analyst ) self . parsed . append ( package . id_ ) if res [ 'success' ] : self . pkg_event = res [ 'object' ] self . imported [ package . id_ ] = ( 'Event' , res [ 'object' ] . id , title ) self . updates [ res [ 'object' ] . id ] = res [ 'object' ] else : self . failed . append ( ( res [ 'message' ] , "Event (%s)" % title , package . id_ ) ) if package . indicators : self . parse_indicators ( package . indicators ) if package . observables and package . observables . observables : self . parse_observables ( package . observables . observables , is_ind = self . obs_as_ind ) if package . threat_actors : self . parse_threat_actors ( package . threat_actors ) if package . ttps : self . parse_ttps ( package . ttps ) if package . incidents : self . parse_incidents ( package . incidents )