(obj, items_to_convert=[], loaded=False, bin_fmt="raw")
return stix_msg
Converts a CRITs object to a STIX document.

    The resulting document includes standardized representations
    of all related objects noted within items_to_convert.

    :param items_to_convert: The list of items to convert to STIX/CybOX
    :type items_to_convert: Either a list of CRITs objects OR
                            a list of {'_type': CRITS_TYPE, '_id': CRITS_ID} dicts
    :param loaded: Set to True if you've passed a list of CRITs objects as
                    the value for items_to_convert, else leave False.
    :type loaded: bool
    :param bin_fmt: Specifies the format for Sample data encoding.
                    Options: None (don't include binary data in STIX output),
                                "raw" (include binary data as is),
                                "base64" (base64 encode binary data)

    :returns: A dict indicating which items mapped to STIX indicators, ['stix_indicators']
                which items mapped to STIX observables, ['stix_observables']
                which items are included in the resulting STIX doc, ['final_objects']
                and the STIX doc itself ['stix_obj'].
Converts a CRITs object to a STIX document.
Converts a CRITs object to a STIX document .
def to_stix(obj, items_to_convert=[], loaded=False, bin_fmt="raw"):
    """
    Converts a CRITs object to a STIX document.

    The resulting document includes standardized representations
    of all related objects noted within items_to_convert.

    :param items_to_convert: The list of items to convert to STIX/CybOX
    :type items_to_convert: Either a list of CRITs objects OR
                            a list of {'_type': CRITS_TYPE, '_id': CRITS_ID} dicts
    :param loaded: Set to True if you've passed a list of CRITs objects as
                    the value for items_to_convert, else leave False.
    :type loaded: bool
    :param bin_fmt: Specifies the format for Sample data encoding.
                    Options: None (don't include binary data in STIX output),
                                "raw" (include binary data as is),
                                "base64" (base64 encode binary data)

    :returns: A dict indicating which items mapped to STIX indicators, ['stix_indicators']
                which items mapped to STIX observables, ['stix_observables']
                which items are included in the resulting STIX doc, ['final_objects']
                and the STIX doc itself ['stix_obj'].
    """

    from cybox.common import Time, ToolInformationList, ToolInformation
    from stix.common import StructuredText, InformationSource
    from stix.core import STIXPackage, STIXHeader
    from stix.common.identity import Identity

    # These lists are used to determine which CRITs objects
    # go in which part of the STIX document.
    ind_list = ['Indicator']
    obs_list = ['Certificate',
                'Domain',
                'Email',
                'IP',
                'PCAP',
                'RawData',
                'Sample']
    actor_list = ['Actor']

    # Store message
    stix_msg = {
                    'stix_incidents': [],
                    'stix_indicators': [],
                    'stix_observables': [],
                    'stix_actors': [],
                    'final_objects': []
                }

    if not loaded: # if we have a list of object metadata, load it before processing
        items_to_convert = [class_from_id(item['_type'], item['_id'])
                                for item in items_to_convert]

    # add self to the list of items to STIXify
    if obj not in items_to_convert:
        items_to_convert.append(obj)

    # add any email attachments
    attachments = []
    for obj in items_to_convert:
        if obj._meta['crits_type'] == 'Email':
            for rel in obj.relationships:
                if rel.relationship == RelationshipTypes.CONTAINS and rel.rel_type == 'Sample':
                    atch = class_from_id('Sample', rel.object_id)
                    if atch not in items_to_convert:
                        attachments.append(atch)
    items_to_convert.extend(attachments)

    # grab ObjectId of items
    refObjs = {key.id: 0 for key in items_to_convert}

    relationships = {}
    stix = []
    from stix.indicator import Indicator as S_Ind
    for obj in items_to_convert:
        obj_type = obj._meta['crits_type']
        if obj_type == class_from_type('Event')._meta['crits_type']:
            stx, release = to_stix_incident(obj)
            stix_msg['stix_incidents'].append(stx)
        elif obj_type in ind_list: # convert to STIX indicators
            stx, releas = to_stix_indicator(obj)
            stix_msg['stix_indicators'].append(stx)
            refObjs[obj.id] = S_Ind(idref=stx.id_)
        elif obj_type in obs_list: # convert to CybOX observable
            if obj_type == class_from_type('Sample')._meta['crits_type']:
                stx, releas = to_cybox_observable(obj, bin_fmt=bin_fmt)
            else:
                stx, releas = to_cybox_observable(obj)

            # wrap in stix Indicator because some STIX objects can't have
            # related_observables and we want to be able to relate observables
            # to anything else
            ind = S_Ind()
            for ob in stx:
                ind.add_observable(ob)
            ind.title = "CRITs %s Top-Level Object" % obj_type
            ind.description = ("This is simply a CRITs %s top-level "
                                "object, not actually an Indicator. "
                                "The Observable is wrapped in an Indicator"
                                " to facilitate documentation of the "
                                "relationship." % obj_type)
            ind.confidence = 'None'
            stx = ind
            stix_msg['stix_indicators'].append(stx)
            refObjs[obj.id] = S_Ind(idref=stx.id_)
        elif obj_type in actor_list: # convert to STIX actor
            stx, releas = to_stix_actor(obj)
            stix_msg['stix_actors'].append(stx)

        # get relationships from CRITs objects
        for rel in obj.relationships:
            if rel.object_id in refObjs:
                relationships.setdefault(stx.id_, {})
                relationships[stx.id_][rel.object_id] = (rel.relationship,
                                                         rel.rel_confidence.capitalize(),
                                                         rel.rel_type)

        stix_msg['final_objects'].append(obj)
        stix.append(stx)

    # set relationships on STIX objects
    for stix_obj in stix: # for each new STIX object
        for rel in relationships.get(stix_obj.id_, {}): # each CRITs oid related to the new STIX object
            if isinstance(refObjs.get(rel), S_Ind): # if a STIX Indicator was made for that CRITs oid
                stix_obj.related_indicators.append(refObjs[rel]) # relate the STIX ind to that new STIX obj
                rel_meta = relationships.get(stix_obj.id_)[rel]
                stix_obj.related_indicators[-1].relationship = rel_meta[0]
                stix_obj.related_indicators[-1].confidence = rel_meta[1]

                # Add any Email Attachments to CybOX EmailMessage Objects
                if isinstance(stix_obj, S_Ind):
                    if 'EmailMessage' in stix_obj.observable.object_.id_:
                        if rel_meta[0] == 'Contains' and rel_meta[2] == 'Sample':
                            email = stix_obj.observable.object_.properties
                            if not email.attachments:
                                email.attachments = Attachments()
                            email.attachments.append(refObjs[rel].idref)

    tool_list = ToolInformationList()
    tool = ToolInformation("CRITs", "MITRE")
    tool.version = settings.CRITS_VERSION
    tool_list.append(tool)
    i_s = InformationSource(
        time=Time(produced_time= datetime.now()),
        identity=Identity(name=settings.COMPANY_NAME),
        tools=tool_list)

    stix_desc = ("This STIX package was generated by the TAXII service "
                 "of CRITs, the open source threat repository. You can "
                 "learn more about CRITs at https://crits.github.io")
    stix_title = "CRITs Generated STIX Package"
    header = STIXHeader(information_source=i_s,
                        description=StructuredText(value=stix_desc),
                        package_intents=["Collective Threat Intelligence"],
                        title=stix_title)

    stix_msg['stix_obj'] = STIXPackage(incidents=stix_msg['stix_incidents'],
                    indicators=stix_msg['stix_indicators'],
                    threat_actors=stix_msg['stix_actors'],
                    stix_header=header)

    return stix_msg
def to_stix ( obj , items_to_convert = [ ] , loaded = False , bin_fmt = "raw" ) : from cybox . common import Time , ToolInformationList , ToolInformation from stix . common import StructuredText , InformationSource from stix . core import STIXPackage , STIXHeader from stix . common . identity import Identity # These lists are used to determine which CRITs objects # go in which part of the STIX document. ind_list = [ 'Indicator' ] obs_list = [ 'Certificate' , 'Domain' , 'Email' , 'IP' , 'PCAP' , 'RawData' , 'Sample' ] actor_list = [ 'Actor' ] # Store message stix_msg = { 'stix_incidents' : [ ] , 'stix_indicators' : [ ] , 'stix_observables' : [ ] , 'stix_actors' : [ ] , 'final_objects' : [ ] } if not loaded : # if we have a list of object metadata, load it before processing items_to_convert = [ class_from_id ( item [ '_type' ] , item [ '_id' ] ) for item in items_to_convert ] # add self to the list of items to STIXify if obj not in items_to_convert : items_to_convert . append ( obj ) # add any email attachments attachments = [ ] for obj in items_to_convert : if obj . _meta [ 'crits_type' ] == 'Email' : for rel in obj . relationships : if rel . relationship == RelationshipTypes . CONTAINS and rel . rel_type == 'Sample' : atch = class_from_id ( 'Sample' , rel . object_id ) if atch not in items_to_convert : attachments . append ( atch ) items_to_convert . extend ( attachments ) # grab ObjectId of items refObjs = { key . id : 0 for key in items_to_convert } relationships = { } stix = [ ] from stix . indicator import Indicator as S_Ind for obj in items_to_convert : obj_type = obj . _meta [ 'crits_type' ] if obj_type == class_from_type ( 'Event' ) . _meta [ 'crits_type' ] : stx , release = to_stix_incident ( obj ) stix_msg [ 'stix_incidents' ] . append ( stx ) elif obj_type in ind_list : # convert to STIX indicators stx , releas = to_stix_indicator ( obj ) stix_msg [ 'stix_indicators' ] . append ( stx ) refObjs [ obj . id ] = S_Ind ( idref = stx . id_ ) elif obj_type in obs_list : # convert to CybOX observable if obj_type == class_from_type ( 'Sample' ) . _meta [ 'crits_type' ] : stx , releas = to_cybox_observable ( obj , bin_fmt = bin_fmt ) else : stx , releas = to_cybox_observable ( obj ) # wrap in stix Indicator because some STIX objects can't have # related_observables and we want to be able to relate observables # to anything else ind = S_Ind ( ) for ob in stx : ind . add_observable ( ob ) ind . title = "CRITs %s Top-Level Object" % obj_type ind . description = ( "This is simply a CRITs %s top-level " "object, not actually an Indicator. " "The Observable is wrapped in an Indicator" " to facilitate documentation of the " "relationship." % obj_type ) ind . confidence = 'None' stx = ind stix_msg [ 'stix_indicators' ] . append ( stx ) refObjs [ obj . id ] = S_Ind ( idref = stx . id_ ) elif obj_type in actor_list : # convert to STIX actor stx , releas = to_stix_actor ( obj ) stix_msg [ 'stix_actors' ] . append ( stx ) # get relationships from CRITs objects for rel in obj . relationships : if rel . object_id in refObjs : relationships . setdefault ( stx . id_ , { } ) relationships [ stx . id_ ] [ rel . object_id ] = ( rel . relationship , rel . rel_confidence . capitalize ( ) , rel . rel_type ) stix_msg [ 'final_objects' ] . append ( obj ) stix . append ( stx ) # set relationships on STIX objects for stix_obj in stix : # for each new STIX object for rel in relationships . get ( stix_obj . id_ , { } ) : # each CRITs oid related to the new STIX object if isinstance ( refObjs . get ( rel ) , S_Ind ) : # if a STIX Indicator was made for that CRITs oid stix_obj . related_indicators . append ( refObjs [ rel ] ) # relate the STIX ind to that new STIX obj rel_meta = relationships . get ( stix_obj . id_ ) [ rel ] stix_obj . related_indicators [ - 1 ] . relationship = rel_meta [ 0 ] stix_obj . related_indicators [ - 1 ] . confidence = rel_meta [ 1 ] # Add any Email Attachments to CybOX EmailMessage Objects if isinstance ( stix_obj , S_Ind ) : if 'EmailMessage' in stix_obj . observable . object_ . id_ : if rel_meta [ 0 ] == 'Contains' and rel_meta [ 2 ] == 'Sample' : email = stix_obj . observable . object_ . properties if not email . attachments : email . attachments = Attachments ( ) email . attachments . append ( refObjs [ rel ] . idref ) tool_list = ToolInformationList ( ) tool = ToolInformation ( "CRITs" , "MITRE" ) tool . version = settings . CRITS_VERSION tool_list . append ( tool ) i_s = InformationSource ( time = Time ( produced_time = datetime . now ( ) ) , identity = Identity ( name = settings . COMPANY_NAME ) , tools = tool_list ) stix_desc = ( "This STIX package was generated by the TAXII service " "of CRITs, the open source threat repository. You can " "learn more about CRITs at https://crits.github.io" ) stix_title = "CRITs Generated STIX Package" header = STIXHeader ( information_source = i_s , description = StructuredText ( value = stix_desc ) , package_intents = [ "Collective Threat Intelligence" ] , title = stix_title ) stix_msg [ 'stix_obj' ] = STIXPackage ( incidents = stix_msg [ 'stix_incidents' ] , indicators = stix_msg [ 'stix_indicators' ] , threat_actors = stix_msg [ 'stix_actors' ] , stix_header = header ) return stix_msg