stixex v0.1.1 API Reference

Modules

Documentation for StixEx, a STIX implementation

It's basically a vocabulary, but different. Apparently. Ask the STIX people I don't hecking know

An object is a set of STIX data with a set schema. The awkward part here is that is can be any kind of type, and they all sit in the same array

The marking-definition object represents a specific marking. Data markings typically represent handling or sharing requirements for data, and are applied in the object_marking_refs and granular_markings properties on STIX Object, which reference a list of IDs for marking-definition objects

The Artifact Object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload. The size of the base64-encoded data captured in the payload_bin property MUST be less than or equal to 10MB

A Sighting denotes the belief that something in CTI (e.g., an indicator, malware, tool, threat actor, etc.) was seen

A parser for stix patterning. It's some fancy-pants set of expressions

Functions to deal with "selectors", little strings of JSONPath-alike format to select from a map

Maintains a map from string-type name to module, since STIX itself won't tell us if something is an observable or not, it's hard to automatically do it

External references are used to describe pointers to information represented outside of STIX

Whereas object markings apply to an entire STIX Object or Marking Definition and all its properties, granular markings allow data markings to be applied to individual portions of STIX Object and Marking Definitions

The Hashes type represents 1 or more cryptographic hashes, as a special set of key/value pairs

It's just a string, but a very certain type of string which we should probably add as a type to avoid confusion... also maybe we should cast it to an integer db-side?

An identifier universally and uniquely identifies a SDO, SRO, Bundle, or Marking Definition. Identifiers MUST follow the form object-type--UUIDv4, where object-type is the exact value (all type names are lowercase strings, by definition) from the type property of the object being identified or referenced and where the UUIDv4 is an RFC 4122-compliant Version 4 UUID

The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objective

This is basically a "wrapper" type to cast from an array of arbitrary types to the structs that define them

The Object Reference data type specifies a local reference to an Observable Object, that is, one which MUST be valid within the local scope of the Observable Objects (observable-objects) container that holds both the source Observable Object and the Observable Object that it references

Some extra validations for checking some of the more esoteric requirements demanded by the spec

Set vocabularies to restrict the values of certain fields to one of a given list

An open vocabulary of encryption algorithms