(self, observables, description='',
                          is_ind=False, ind_id=None, ind_ci=None)
Parse list of observables in STIX doc.

        :param observables: List of STIX observables.
        :type observables: List of STIX observables.
        :param description: Parent-level (e.g. Indicator) description.
        :type description: str
        :param is_ind: Whether the observable is actually an Indicator
        :type is_ind: boolean
        :param ind_id: The ID of a parent STIX Indicator.
        :type ind_id: str
        :param ind_ci: The (confidence, impact) of a parent STIX Indicator.
        :type ind_ci: tuple
Parse list of observables in STIX doc.
Parse list of observables in STIX doc .
def parse_observables(self, observables, description='',
                          is_ind=False, ind_id=None, ind_ci=None):
        """
        Parse list of observables in STIX doc.

        :param observables: List of STIX observables.
        :type observables: List of STIX observables.
        :param description: Parent-level (e.g. Indicator) description.
        :type description: str
        :param is_ind: Whether the observable is actually an Indicator
        :type is_ind: boolean
        :param ind_id: The ID of a parent STIX Indicator.
        :type ind_id: str
        :param ind_ci: The (confidence, impact) of a parent STIX Indicator.
        :type ind_ci: tuple
        """

        for ob in observables: # for each STIX observable
            p_id = ind_id or ob.id_ # use Indicator ID if given, otherwise Observable ID
            if not ob.object_:
                if ob.idref: # query saved TAXII content for referenced ID
                    txC = taxii.TaxiiContent
                    refQ = 'id="' + ob.idref
                    xmlblock = txC.objects(content__contains=refQ).first()
                    if xmlblock:
                        if isinstance(xmlblock.content, unicode): # BytesIO requires str
                            xmlblock.content = xmlblock.content.encode('utf-8')
                            encoding = 'utf-8'
                        else: # String has unknown encoding
                            encoding = None
                        with closing(BytesIO(xmlblock.content)) as f:
                            ref_pkg = STIXPackage.from_xml(f, encoding)
                        if 'Observable' in ob.idref:
                            self.parse_observables(ref_pkg.observables.observables,
                                                   description, is_ind, p_id, ind_ci)

                            if self.preview: # no need to store relationship if just a preview
                                continue

                            if ref_pkg.observables.observables[0].object_:
                                cbxid = ref_pkg.observables.observables[0].object_.id_
                                self.idMap.setdefault(ob.idref, []).append(cbxid)
                            elif ref_pkg.observables.observables[0].idref in self.idMap:
                                subref = ref_pkg.observables.observables[0].idref
                                self.idMap.setdefault(ob.idref, []).extend(self.idMap.pop(subref))
                    continue

                elif ob.observable_composition: # parse observable composition.
                    # CRITs doesn't support complex boolean relationships like
                    # ((A OR B) AND C). This code simply imports all observables
                    # and forms "Related_To" relationships between them
                    self.parse_observables(ob.observable_composition.observables,
                                           description, is_ind, p_id, ind_ci)
                    rel_ids = []

                    if self.preview: # no need to store relationship if just a preview
                        continue

                    for com_ob in ob.observable_composition.observables:
                        if com_ob.object_:
                            rel_ids.append(com_ob.object_.id_)
                        else:
                            xid = com_ob.id_ or com_ob.idref
                            if xid in self.idMap:
                                rel_ids.extend(self.idMap.pop(xid))
                            else:
                                rel_ids.append(xid)
                    if len(observables) > 1:
                        self.idMap.setdefault(ob.id_, []).extend(rel_ids)
                    else: # This is the top level, so form relationships
                        for oid in rel_ids:
                            for oid2 in rel_ids:
                                if oid != oid2:
                                    self.relationships.append((oid,
                                                               RelationshipTypes.RELATED_TO,
                                                               oid2, "High"))
                    continue

                self.failed.append(("No valid CybOX object_ or refid found!",
                                    "Observable (%s)" % ob.id_,
                                    ob.id_)) # note for display in UI
                continue

            description = [description]
            if ob.title:
                description.append('STIX Observable Title: %s' % ob.title)
            if ob.description:
                description.append('STIX Observable Description: %s' % ob.description)
            description = '\n'.join(x for x in description if x)
            self.parse_cybox_object(ob.object_, description, is_ind, p_id, ind_ci)
def parse_observables ( self , observables , description = '' , is_ind = False , ind_id = None , ind_ci = None ) : for ob in observables : # for each STIX observable p_id = ind_id or ob . id_ # use Indicator ID if given, otherwise Observable ID if not ob . object_ : if ob . idref : # query saved TAXII content for referenced ID txC = taxii . TaxiiContent refQ = 'id="' + ob . idref xmlblock = txC . objects ( content__contains = refQ ) . first ( ) if xmlblock : if isinstance ( xmlblock . content , unicode ) : # BytesIO requires str xmlblock . content = xmlblock . content . encode ( 'utf-8' ) encoding = 'utf-8' else : # String has unknown encoding encoding = None with closing ( BytesIO ( xmlblock . content ) ) as f : ref_pkg = STIXPackage . from_xml ( f , encoding ) if 'Observable' in ob . idref : self . parse_observables ( ref_pkg . observables . observables , description , is_ind , p_id , ind_ci ) if self . preview : # no need to store relationship if just a preview continue if ref_pkg . observables . observables [ 0 ] . object_ : cbxid = ref_pkg . observables . observables [ 0 ] . object_ . id_ self . idMap . setdefault ( ob . idref , [ ] ) . append ( cbxid ) elif ref_pkg . observables . observables [ 0 ] . idref in self . idMap : subref = ref_pkg . observables . observables [ 0 ] . idref self . idMap . setdefault ( ob . idref , [ ] ) . extend ( self . idMap . pop ( subref ) ) continue elif ob . observable_composition : # parse observable composition. # CRITs doesn't support complex boolean relationships like # ((A OR B) AND C). This code simply imports all observables # and forms "Related_To" relationships between them self . parse_observables ( ob . observable_composition . observables , description , is_ind , p_id , ind_ci ) rel_ids = [ ] if self . preview : # no need to store relationship if just a preview continue for com_ob in ob . observable_composition . observables : if com_ob . object_ : rel_ids . append ( com_ob . object_ . id_ ) else : xid = com_ob . id_ or com_ob . idref if xid in self . idMap : rel_ids . extend ( self . idMap . pop ( xid ) ) else : rel_ids . append ( xid ) if len ( observables ) > 1 : self . idMap . setdefault ( ob . id_ , [ ] ) . extend ( rel_ids ) else : # This is the top level, so form relationships for oid in rel_ids : for oid2 in rel_ids : if oid != oid2 : self . relationships . append ( ( oid , RelationshipTypes . RELATED_TO , oid2 , "High" ) ) continue self . failed . append ( ( "No valid CybOX object_ or refid found!" , "Observable (%s)" % ob . id_ , ob . id_ ) ) # note for display in UI continue description = [ description ] if ob . title : description . append ( 'STIX Observable Title: %s' % ob . title ) if ob . description : description . append ( 'STIX Observable Description: %s' % ob . description ) description = '\n' . join ( x for x in description if x ) self . parse_cybox_object ( ob . object_ , description , is_ind , p_id , ind_ci )