stixex v0.1.3 API Reference
Modules
Documentation for StixEx, a STIX implementation
A Bundle is a collection of arbitrary STIX Objects and Marking Definitions grouped together in a single container. A Bundle does not have any semantic meaning and Objects are not considered related by virtue of being in the same Bundle
Like a vocabulary but it FORCES values to be part of it, instead of sending them a strongly worded letter if they don't
The marking-definition object represents a specific marking. Data markings typically represent handling or sharing requirements for data, and are applied in the object_marking_refs and granular_markings properties on STIX Object, which reference a list of IDs for marking-definition objects
An object is a set of STIX data with a set schema. The awkward part here is that is can be any kind of type, and they all sit in the same array
The Artifact Object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload. The size of the base64-encoded data captured in the payload_bin property MUST be less than or equal to 10MB
A Sighting denotes the belief that something in CTI (e.g., an indicator, malware, tool, threat actor, etc.) was seen
A parser for stix patterning. It's some fancy-pants set of expressions
Functions to deal with "selectors", little strings of JSONPath-alike format to select from a map
Ways to dump stix to a file - only JSON has to be implemented
Maintains a map from string-type name to module, since STIX itself won't tell us if something is an observable or not, it's hard to automatically do it
External references are used to describe pointers to information represented outside of STIX
Whereas object markings apply to an entire STIX Object or Marking Definition and all its properties, granular markings allow data markings to be applied to individual portions of STIX Object and Marking Definitions
The Hashes type represents 1 or more cryptographic hashes, as a special set of key/value pairs
It's just a string, but a very certain type of string which we should probably add as a type to avoid confusion... also maybe we should cast it to an integer db-side?
An identifier universally and uniquely identifies a SDO, SRO, Bundle, or Marking Definition. Identifiers MUST follow the form object-type--UUIDv4, where object-type is the exact value (all type names are lowercase strings, by definition) from the type property of the object being identified or referenced and where the UUIDv4 is an RFC 4122-compliant Version 4 UUID
The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objective
This is basically a "wrapper" type to cast from an array of arbitrary types to the structs that define them
The Object Reference data type specifies a local reference to an Observable Object, that is, one which MUST be valid within the local scope of the Observable Objects (observable-objects) container that holds both the source Observable Object and the Observable Object that it references
Some extra validations for checking some of the more esoteric requirements demanded by the spec
Set vocabularies to restrict the values of certain fields to one of a given list
An open vocabulary of encryption algorithms