(obj, exclude=None, bin_fmt="raw")
Convert a CRITs TLO to a CybOX Observable.

    :param obj: The TLO to convert.
    :type obj: :class:`crits.core.crits_mongoengine.CRITsBaseAttributes`
    :param exclude: Attributes to exclude.
    :type exclude: list
    :param bin_fmt: The format for the binary (if applicable).
    :type bin_fmt: str
Convert a CRITs TLO to a CybOX Observable.
Convert a CRITs TLO to a CybOX Observable .
def to_cybox_observable(obj, exclude=None, bin_fmt="raw"):
    """
    Convert a CRITs TLO to a CybOX Observable.

    :param obj: The TLO to convert.
    :type obj: :class:`crits.core.crits_mongoengine.CRITsBaseAttributes`
    :param exclude: Attributes to exclude.
    :type exclude: list
    :param bin_fmt: The format for the binary (if applicable).
    :type bin_fmt: str
    """

    type_ = obj._meta['crits_type']
    if type_ == 'Certificate':
        custom_prop = Property() # make a custom property so CRITs import can identify Certificate exports
        custom_prop.name = "crits_type"
        custom_prop.description = "Indicates the CRITs type of the object this CybOX object represents"
        custom_prop._value = "Certificate"
        obje = File() # represent cert information as file
        obje.md5 = obj.md5
        obje.file_name = obj.filename
        obje.file_format = obj.filetype
        obje.size_in_bytes = obj.size
        obje.custom_properties = CustomProperties()
        obje.custom_properties.append(custom_prop)
        obs = Observable(obje)
        obs.description = obj.description
        data = obj.filedata.read()
        if data: # if cert data available
            a = Artifact(data, Artifact.TYPE_FILE) # create artifact w/data
            a.packaging.append(Base64Encoding())
            obje.add_related(a, "Child_Of") # relate artifact to file
        return ([obs], obj.releasability)
    elif type_ == 'Domain':
        obje = DomainName()
        obje.value = obj.domain
        obje.type_ = obj.record_type
        return ([Observable(obje)], obj.releasability)
    elif type_ == 'Email':
        if exclude == None:
            exclude = []

        observables = []

        obje = EmailMessage()
        # Assume there is going to be at least one header
        obje.header = EmailHeader()

        if 'message_id' not in exclude:
            obje.header.message_id = String(obj.message_id)

        if 'subject' not in exclude:
            obje.header.subject = String(obj.subject)

        if 'sender' not in exclude:
            obje.header.sender = Address(obj.sender, Address.CAT_EMAIL)

        if 'reply_to' not in exclude:
            obje.header.reply_to = Address(obj.reply_to, Address.CAT_EMAIL)

        if 'x_originating_ip' not in exclude:
            obje.header.x_originating_ip = Address(obj.x_originating_ip,
                                                  Address.CAT_IPV4)

        if 'x_mailer' not in exclude:
            obje.header.x_mailer = String(obj.x_mailer)

        if 'boundary' not in exclude:
            obje.header.boundary = String(obj.boundary)

        if 'raw_body' not in exclude:
            obje.raw_body = obj.raw_body

        if 'raw_header' not in exclude:
            obje.raw_header = obj.raw_header

        #copy fields where the names differ between objects
        if 'helo' not in exclude and 'email_server' not in exclude:
            obje.email_server = String(obj.helo)
        if ('from_' not in exclude and 'from' not in exclude and
            'from_address' not in exclude):
            obje.header.from_ = EmailAddress(obj.from_address)
        if 'date' not in exclude and 'isodate' not in exclude:
            obje.header.date = DateTime(obj.isodate)

        obje.attachments = Attachments()

        observables.append(Observable(obje))
        return (observables, obj.releasability)
    elif type_ == 'Indicator':
        observables = []
        obje = make_cybox_object(obj.ind_type, obj.value)
        observables.append(Observable(obje))
        return (observables, obj.releasability)
    elif type_ == 'IP':
        obje = Address()
        obje.address_value = obj.ip
        if obj.ip_type == IPTypes.IPV4_ADDRESS:
            obje.category = "ipv4-addr"
        elif obj.ip_type == IPTypes.IPV6_ADDRESS:
            obje.category = "ipv6-addr"
        elif obj.ip_type == IPTypes.IPV4_SUBNET:
            obje.category = "ipv4-net"
        elif obj.ip_type == IPTypes.IPV6_SUBNET:
            obje.category = "ipv6-subnet"
        return ([Observable(obje)], obj.releasability)
    elif type_ == 'PCAP':
        obje = File()
        obje.md5 = obj.md5
        obje.file_name = obj.filename
        obje.file_format = obj.contentType
        obje.size_in_bytes = obj.length
        obs = Observable(obje)
        obs.description = obj.description
        art = Artifact(obj.filedata.read(), Artifact.TYPE_NETWORK)
        art.packaging.append(Base64Encoding())
        obje.add_related(art, "Child_Of") # relate artifact to file
        return ([obs], obj.releasability)
    elif type_ == 'RawData':
        obje = Artifact(obj.data.encode('utf-8'), Artifact.TYPE_FILE)
        obje.packaging.append(Base64Encoding())
        obs = Observable(obje)
        obs.description = obj.description
        return ([obs], obj.releasability)
    elif type_ == 'Sample':
        if exclude == None:
            exclude = []

        observables = []
        f = File()
        for attr in ['md5', 'sha1', 'sha256']:
            if attr not in exclude:
                val = getattr(obj, attr, None)
                if val:
                    setattr(f, attr, val)
        if obj.ssdeep and 'ssdeep' not in exclude:
            f.add_hash(Hash(obj.ssdeep, Hash.TYPE_SSDEEP))
        if 'size' not in exclude and 'size_in_bytes' not in exclude:
            f.size_in_bytes = UnsignedLong(obj.size)
        if 'filename' not in exclude and 'file_name' not in exclude:
            f.file_name = obj.filename
        # create an Artifact object for the binary if it exists
        if 'filedata' not in exclude and bin_fmt:
            data = obj.filedata.read()
            if data: # if sample data available
                a = Artifact(data, Artifact.TYPE_FILE) # create artifact w/data
                if bin_fmt == "zlib":
                    a.packaging.append(ZlibCompression())
                    a.packaging.append(Base64Encoding())
                elif bin_fmt == "base64":
                    a.packaging.append(Base64Encoding())
                f.add_related(a, "Child_Of") # relate artifact to file
        if 'filetype' not in exclude and 'file_format' not in exclude:
            #NOTE: this doesn't work because the CybOX File object does not
            #   have any support built in for setting the filetype to a
            #   CybOX-binding friendly object (e.g., calling .to_dict() on
            #   the resulting CybOX object fails on this field.
            f.file_format = obj.filetype
        observables.append(Observable(f))
        return (observables, obj.releasability)
    else:
        return (None, None)
def to_cybox_observable ( obj , exclude = None , bin_fmt = "raw" ) : type_ = obj . _meta [ 'crits_type' ] if type_ == 'Certificate' : custom_prop = Property ( ) # make a custom property so CRITs import can identify Certificate exports custom_prop . name = "crits_type" custom_prop . description = "Indicates the CRITs type of the object this CybOX object represents" custom_prop . _value = "Certificate" obje = File ( ) # represent cert information as file obje . md5 = obj . md5 obje . file_name = obj . filename obje . file_format = obj . filetype obje . size_in_bytes = obj . size obje . custom_properties = CustomProperties ( ) obje . custom_properties . append ( custom_prop ) obs = Observable ( obje ) obs . description = obj . description data = obj . filedata . read ( ) if data : # if cert data available a = Artifact ( data , Artifact . TYPE_FILE ) # create artifact w/data a . packaging . append ( Base64Encoding ( ) ) obje . add_related ( a , "Child_Of" ) # relate artifact to file return ( [ obs ] , obj . releasability ) elif type_ == 'Domain' : obje = DomainName ( ) obje . value = obj . domain obje . type_ = obj . record_type return ( [ Observable ( obje ) ] , obj . releasability ) elif type_ == 'Email' : if exclude == None : exclude = [ ] observables = [ ] obje = EmailMessage ( ) # Assume there is going to be at least one header obje . header = EmailHeader ( ) if 'message_id' not in exclude : obje . header . message_id = String ( obj . message_id ) if 'subject' not in exclude : obje . header . subject = String ( obj . subject ) if 'sender' not in exclude : obje . header . sender = Address ( obj . sender , Address . CAT_EMAIL ) if 'reply_to' not in exclude : obje . header . reply_to = Address ( obj . reply_to , Address . CAT_EMAIL ) if 'x_originating_ip' not in exclude : obje . header . x_originating_ip = Address ( obj . x_originating_ip , Address . CAT_IPV4 ) if 'x_mailer' not in exclude : obje . header . x_mailer = String ( obj . x_mailer ) if 'boundary' not in exclude : obje . header . boundary = String ( obj . boundary ) if 'raw_body' not in exclude : obje . raw_body = obj . raw_body if 'raw_header' not in exclude : obje . raw_header = obj . raw_header #copy fields where the names differ between objects if 'helo' not in exclude and 'email_server' not in exclude : obje . email_server = String ( obj . helo ) if ( 'from_' not in exclude and 'from' not in exclude and 'from_address' not in exclude ) : obje . header . from_ = EmailAddress ( obj . from_address ) if 'date' not in exclude and 'isodate' not in exclude : obje . header . date = DateTime ( obj . isodate ) obje . attachments = Attachments ( ) observables . append ( Observable ( obje ) ) return ( observables , obj . releasability ) elif type_ == 'Indicator' : observables = [ ] obje = make_cybox_object ( obj . ind_type , obj . value ) observables . append ( Observable ( obje ) ) return ( observables , obj . releasability ) elif type_ == 'IP' : obje = Address ( ) obje . address_value = obj . ip if obj . ip_type == IPTypes . IPV4_ADDRESS : obje . category = "ipv4-addr" elif obj . ip_type == IPTypes . IPV6_ADDRESS : obje . category = "ipv6-addr" elif obj . ip_type == IPTypes . IPV4_SUBNET : obje . category = "ipv4-net" elif obj . ip_type == IPTypes . IPV6_SUBNET : obje . category = "ipv6-subnet" return ( [ Observable ( obje ) ] , obj . releasability ) elif type_ == 'PCAP' : obje = File ( ) obje . md5 = obj . md5 obje . file_name = obj . filename obje . file_format = obj . contentType obje . size_in_bytes = obj . length obs = Observable ( obje ) obs . description = obj . description art = Artifact ( obj . filedata . read ( ) , Artifact . TYPE_NETWORK ) art . packaging . append ( Base64Encoding ( ) ) obje . add_related ( art , "Child_Of" ) # relate artifact to file return ( [ obs ] , obj . releasability ) elif type_ == 'RawData' : obje = Artifact ( obj . data . encode ( 'utf-8' ) , Artifact . TYPE_FILE ) obje . packaging . append ( Base64Encoding ( ) ) obs = Observable ( obje ) obs . description = obj . description return ( [ obs ] , obj . releasability ) elif type_ == 'Sample' : if exclude == None : exclude = [ ] observables = [ ] f = File ( ) for attr in [ 'md5' , 'sha1' , 'sha256' ] : if attr not in exclude : val = getattr ( obj , attr , None ) if val : setattr ( f , attr , val ) if obj . ssdeep and 'ssdeep' not in exclude : f . add_hash ( Hash ( obj . ssdeep , Hash . TYPE_SSDEEP ) ) if 'size' not in exclude and 'size_in_bytes' not in exclude : f . size_in_bytes = UnsignedLong ( obj . size ) if 'filename' not in exclude and 'file_name' not in exclude : f . file_name = obj . filename # create an Artifact object for the binary if it exists if 'filedata' not in exclude and bin_fmt : data = obj . filedata . read ( ) if data : # if sample data available a = Artifact ( data , Artifact . TYPE_FILE ) # create artifact w/data if bin_fmt == "zlib" : a . packaging . append ( ZlibCompression ( ) ) a . packaging . append ( Base64Encoding ( ) ) elif bin_fmt == "base64" : a . packaging . append ( Base64Encoding ( ) ) f . add_related ( a , "Child_Of" ) # relate artifact to file if 'filetype' not in exclude and 'file_format' not in exclude : #NOTE: this doesn't work because the CybOX File object does not #   have any support built in for setting the filetype to a #   CybOX-binding friendly object (e.g., calling .to_dict() on #   the resulting CybOX object fails on this field. f . file_format = obj . filetype observables . append ( Observable ( f ) ) return ( observables , obj . releasability ) else : return ( None , None )