qarbaal 0.1.0__tar.gz

qarbaal-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ahur4
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

qarbaal-0.1.0/PKG-INFO

@@ -0,0 +1,154 @@
+Metadata-Version: 2.4
+Name: qarbaal
+Version: 0.1.0
+Summary: Extract, normalize, validate, and export indicators of compromise from text and files.
+Author: ahur4
+License-Expression: MIT
+Project-URL: Documentation, https://ahur4.github.io/Qarbaal/
+Project-URL: Homepage, https://github.com/ahur4/Qarbaal
+Project-URL: Source, https://github.com/ahur4/Qarbaal
+Project-URL: Repository, https://github.com/ahur4/Qarbaal
+Project-URL: Issues, https://github.com/ahur4/Qarbaal/issues
+Project-URL: Changelog, https://github.com/ahur4/Qarbaal/blob/main/CHANGELOG.md
+Keywords: ioc,threat-intelligence,dfir,cti,stix,indicators,qarbaal
+Classifier: Development Status :: 4 - Beta
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: html
+Requires-Dist: beautifulsoup4>=4.12; extra == "html"
+Provides-Extra: pdf
+Requires-Dist: pymupdf>=1.24; extra == "pdf"
+Provides-Extra: docx
+Requires-Dist: python-docx>=1.1; extra == "docx"
+Provides-Extra: yaml
+Requires-Dist: pyyaml>=6.0; extra == "yaml"
+Provides-Extra: pcap
+Requires-Dist: scapy>=2.5; extra == "pcap"
+Provides-Extra: pydantic
+Requires-Dist: pydantic>=2.4; extra == "pydantic"
+Provides-Extra: all
+Requires-Dist: beautifulsoup4>=4.12; extra == "all"
+Requires-Dist: pymupdf>=1.24; extra == "all"
+Requires-Dist: python-docx>=1.1; extra == "all"
+Requires-Dist: pyyaml>=6.0; extra == "all"
+Requires-Dist: scapy>=2.5; extra == "all"
+Requires-Dist: pydantic>=2.4; extra == "all"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: mypy>=1.13; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9.5; extra == "docs"
+Requires-Dist: mkdocstrings[python]>=0.26; extra == "docs"
+Dynamic: license-file
+
+# qarbaal
+
+Extract, normalize, validate, and export indicators of compromise from text and files.
+
+[![Python 3.10–3.13](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776AB)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/github/license/ahur4/Qarbaal)](https://github.com/ahur4/Qarbaal/blob/main/LICENSE)
+[![CI](https://img.shields.io/github/actions/workflow/status/ahur4/Qarbaal/ci.yml?branch=main&label=CI)](https://github.com/ahur4/Qarbaal/actions/workflows/ci.yml)
+[![Documentation](https://img.shields.io/badge/docs-mkdocs-0A7AAA)](https://ahur4.github.io/Qarbaal/)
+
+**Documentation:** <https://ahur4.github.io/Qarbaal/>
+
+`qarbaal` reads reports, logs, and message files on your machine and returns classified indicators. It refangs defanged text, records where each value came from, and writes CSV, JSON, STIX 2.1, MISP, OpenIOC, and network rules. The base install uses only the Python standard library. It does not call an enrichment API.
+
+## Installation
+
+Python 3.10 or newer.
+
+```console
+pip install qarbaal
+```
+
+That install has no runtime dependencies. Optional readers are separate extras:
+
+```console
+pip install "qarbaal[html]"    # HTML
+pip install "qarbaal[pdf]"     # PDF
+pip install "qarbaal[docx]"    # Word
+pip install "qarbaal[yaml]"    # YAML
+pip install "qarbaal[pcap]"    # packet captures
+pip install "qarbaal[pydantic]"
+pip install "qarbaal[all]"
+```
+
+## Quickstart
+
+```python
+from qarbaal import IOCExtractor, extract
+
+report = """
+From: support[at]corp-it-desk[.]com
+Lure: hxxps://login[.]corp-it-desk[.]com/session
+Beacon: 185.220.101.42
+MD5: d41d8cd98f00b204e9800998ecf8427e
+"""
+
+result = extract(report)
+for indicator in result:
+    print(indicator.type, indicator.value, indicator.tags, indicator.line)
+
+extractor = IOCExtractor(
+    extract_types=["ipv4", "domain", "url", "hash", "email"],
+    normalize=True,
+    validate=True,
+    deduplicate=True,
+)
+same = extractor.extract(report, source="ticket-14")
+```
+
+`extract()` uses the default type set. File paths, mutex names, and User-Agent strings stay out of that set until you ask for them with `extract_types` or `"all"`.
+
+A synthetic incident is included:
+
+```python
+from qarbaal import SAMPLE, extract
+
+print(extract(SAMPLE).stats.counts)
+```
+
+## What you get back
+
+Each indicator keeps three strings:
+
+| Field | Meaning |
+| --- | --- |
+| `value` | First-seen sieve form. Hashes are lower case, CVE IDs are upper case. |
+| `raw` | Exact slice of the source, which may still be defanged. |
+| `normalized` | Canonical form used for the fingerprint. |
+
+It also carries noise tags, a validation result, a confidence heuristic, local enrichment, pivot links, and one sighting per occurrence (source, line, offset, and page when the file has pages).
+
+## Command line
+
+```console
+qarbaal report.txt
+qarbaal mail.eml notes.json -f stix -o bundle.json
+qarbaal --hide-private --defang -f table alerts.log
+qarbaal --types all -f suricata capture.txt
+```
+
+With no file, `qarbaal` reads stdin. Formats: `table`, `csv`, `json`, `jsonl`, `stix`, `list`, `misp`, `openioc`, `suricata`, `snort`.
+
+## Further reading
+
+- [Installation](https://ahur4.github.io/Qarbaal/installation/)
+- [Indicator types](https://ahur4.github.io/Qarbaal/indicator-types/)
+- [Defanging](https://ahur4.github.io/Qarbaal/defanging/)
+- [Normalization](https://ahur4.github.io/Qarbaal/normalization/)
+- [Exports](https://ahur4.github.io/Qarbaal/exports/)
+- [Command line](https://ahur4.github.io/Qarbaal/cli/)
+- [API reference](https://ahur4.github.io/Qarbaal/reference/)
+- [Changelog](https://ahur4.github.io/Qarbaal/changelog/)

qarbaal-0.1.0/README.md

@@ -0,0 +1,101 @@
+# qarbaal
+
+Extract, normalize, validate, and export indicators of compromise from text and files.
+
+[![Python 3.10–3.13](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-3776AB)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/github/license/ahur4/Qarbaal)](https://github.com/ahur4/Qarbaal/blob/main/LICENSE)
+[![CI](https://img.shields.io/github/actions/workflow/status/ahur4/Qarbaal/ci.yml?branch=main&label=CI)](https://github.com/ahur4/Qarbaal/actions/workflows/ci.yml)
+[![Documentation](https://img.shields.io/badge/docs-mkdocs-0A7AAA)](https://ahur4.github.io/Qarbaal/)
+
+**Documentation:** <https://ahur4.github.io/Qarbaal/>
+
+`qarbaal` reads reports, logs, and message files on your machine and returns classified indicators. It refangs defanged text, records where each value came from, and writes CSV, JSON, STIX 2.1, MISP, OpenIOC, and network rules. The base install uses only the Python standard library. It does not call an enrichment API.
+
+## Installation
+
+Python 3.10 or newer.
+
+```console
+pip install qarbaal
+```
+
+That install has no runtime dependencies. Optional readers are separate extras:
+
+```console
+pip install "qarbaal[html]"    # HTML
+pip install "qarbaal[pdf]"     # PDF
+pip install "qarbaal[docx]"    # Word
+pip install "qarbaal[yaml]"    # YAML
+pip install "qarbaal[pcap]"    # packet captures
+pip install "qarbaal[pydantic]"
+pip install "qarbaal[all]"
+```
+
+## Quickstart
+
+```python
+from qarbaal import IOCExtractor, extract
+
+report = """
+From: support[at]corp-it-desk[.]com
+Lure: hxxps://login[.]corp-it-desk[.]com/session
+Beacon: 185.220.101.42
+MD5: d41d8cd98f00b204e9800998ecf8427e
+"""
+
+result = extract(report)
+for indicator in result:
+    print(indicator.type, indicator.value, indicator.tags, indicator.line)
+
+extractor = IOCExtractor(
+    extract_types=["ipv4", "domain", "url", "hash", "email"],
+    normalize=True,
+    validate=True,
+    deduplicate=True,
+)
+same = extractor.extract(report, source="ticket-14")
+```
+
+`extract()` uses the default type set. File paths, mutex names, and User-Agent strings stay out of that set until you ask for them with `extract_types` or `"all"`.
+
+A synthetic incident is included:
+
+```python
+from qarbaal import SAMPLE, extract
+
+print(extract(SAMPLE).stats.counts)
+```
+
+## What you get back
+
+Each indicator keeps three strings:
+
+| Field | Meaning |
+| --- | --- |
+| `value` | First-seen sieve form. Hashes are lower case, CVE IDs are upper case. |
+| `raw` | Exact slice of the source, which may still be defanged. |
+| `normalized` | Canonical form used for the fingerprint. |
+
+It also carries noise tags, a validation result, a confidence heuristic, local enrichment, pivot links, and one sighting per occurrence (source, line, offset, and page when the file has pages).
+
+## Command line
+
+```console
+qarbaal report.txt
+qarbaal mail.eml notes.json -f stix -o bundle.json
+qarbaal --hide-private --defang -f table alerts.log
+qarbaal --types all -f suricata capture.txt
+```
+
+With no file, `qarbaal` reads stdin. Formats: `table`, `csv`, `json`, `jsonl`, `stix`, `list`, `misp`, `openioc`, `suricata`, `snort`.
+
+## Further reading
+
+- [Installation](https://ahur4.github.io/Qarbaal/installation/)
+- [Indicator types](https://ahur4.github.io/Qarbaal/indicator-types/)
+- [Defanging](https://ahur4.github.io/Qarbaal/defanging/)
+- [Normalization](https://ahur4.github.io/Qarbaal/normalization/)
+- [Exports](https://ahur4.github.io/Qarbaal/exports/)
+- [Command line](https://ahur4.github.io/Qarbaal/cli/)
+- [API reference](https://ahur4.github.io/Qarbaal/reference/)
+- [Changelog](https://ahur4.github.io/Qarbaal/changelog/)

qarbaal-0.1.0/pyproject.toml

@@ -0,0 +1,102 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "qarbaal"
+version = "0.1.0"
+description = "Extract, normalize, validate, and export indicators of compromise from text and files."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "ahur4" }]
+keywords = [
+    "ioc",
+    "threat-intelligence",
+    "dfir",
+    "cti",
+    "stix",
+    "indicators",
+    "qarbaal",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.optional-dependencies]
+html = ["beautifulsoup4>=4.12"]
+pdf = ["pymupdf>=1.24"]
+docx = ["python-docx>=1.1"]
+yaml = ["pyyaml>=6.0"]
+pcap = ["scapy>=2.5"]
+pydantic = ["pydantic>=2.4"]
+all = [
+    "beautifulsoup4>=4.12",
+    "pymupdf>=1.24",
+    "python-docx>=1.1",
+    "pyyaml>=6.0",
+    "scapy>=2.5",
+    "pydantic>=2.4",
+]
+dev = [
+    "pytest>=8.0",
+    "mypy>=1.13",
+    "ruff>=0.8",
+]
+docs = [
+    "mkdocs-material>=9.5",
+    "mkdocstrings[python]>=0.26",
+]
+
+[project.urls]
+Documentation = "https://ahur4.github.io/Qarbaal/"
+Homepage = "https://github.com/ahur4/Qarbaal"
+Source = "https://github.com/ahur4/Qarbaal"
+Repository = "https://github.com/ahur4/Qarbaal"
+Issues = "https://github.com/ahur4/Qarbaal/issues"
+Changelog = "https://github.com/ahur4/Qarbaal/blob/main/CHANGELOG.md"
+
+[project.scripts]
+qarbaal = "qarbaal.cli:main"
+
+[tool.setuptools.packages.find]
+include = ["qarbaal*"]
+
+[tool.setuptools.package-data]
+qarbaal = ["py.typed", "data/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 100
+src = ["qarbaal", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF", "C4"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["qarbaal"]
+
+[tool.ruff.lint.per-file-ignores]
+"qarbaal/ingest.py" = ["B009"]
+"qarbaal/adapters.py" = ["B009"]
+"qarbaal/patterns.py" = ["SIM905"]
+"qarbaal/sample.py" = ["E501"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+packages = ["qarbaal"]
+warn_unused_ignores = true

qarbaal-0.1.0/qarbaal/__init__.py

@@ -0,0 +1,77 @@
+"""Extract, normalize, and export indicators of compromise.
+
+``qarbaal`` reads text and common file formats locally. It does not call a
+network service. Pivot URLs are built for the analyst to open.
+"""
+
+from __future__ import annotations
+
+from qarbaal.exceptions import (
+    InputTooLargeError,
+    OptionalDependencyError,
+    ParseError,
+    QarbaalError,
+    UnsupportedFormatError,
+)
+from qarbaal.export import (
+    to_csv,
+    to_defanged_list,
+    to_json,
+    to_jsonl,
+    to_misp,
+    to_openioc,
+    to_snort,
+    to_stix,
+    to_suricata,
+)
+from qarbaal.extract import IOCExtractor, extract, merge
+from qarbaal.ingest import LoadedDocument, load_document
+from qarbaal.normalize import normalize_value
+from qarbaal.patterns import PatternSpec
+from qarbaal.refang import defang, refang
+from qarbaal.sample import SAMPLE
+from qarbaal.types import (
+    Enrichment,
+    Extraction,
+    ExtractionStats,
+    Indicator,
+    IOCType,
+    Sighting,
+)
+from qarbaal.validate import ipv4_class
+from qarbaal.version import __version__
+
+__all__ = [
+    "SAMPLE",
+    "Enrichment",
+    "Extraction",
+    "ExtractionStats",
+    "IOCExtractor",
+    "IOCType",
+    "Indicator",
+    "InputTooLargeError",
+    "LoadedDocument",
+    "OptionalDependencyError",
+    "ParseError",
+    "PatternSpec",
+    "QarbaalError",
+    "Sighting",
+    "UnsupportedFormatError",
+    "__version__",
+    "defang",
+    "extract",
+    "ipv4_class",
+    "load_document",
+    "merge",
+    "normalize_value",
+    "refang",
+    "to_csv",
+    "to_defanged_list",
+    "to_json",
+    "to_jsonl",
+    "to_misp",
+    "to_openioc",
+    "to_snort",
+    "to_stix",
+    "to_suricata",
+]

qarbaal-0.1.0/qarbaal/__main__.py

@@ -0,0 +1,7 @@
+"""``python -m qarbaal``."""
+
+from __future__ import annotations
+
+from qarbaal.cli import main
+
+raise SystemExit(main())

qarbaal-0.1.0/qarbaal/adapters.py

@@ -0,0 +1,98 @@
+"""Optional pydantic models.
+
+The core result types are dataclasses. This module builds a pydantic model only
+when pydantic is installed (``pip install 'qarbaal[pydantic]'``).
+"""
+
+from __future__ import annotations
+
+import importlib
+from collections.abc import Callable
+from functools import lru_cache
+from typing import Protocol, cast
+
+from qarbaal.exceptions import OptionalDependencyError
+from qarbaal.export import indicator_to_dict
+from qarbaal.types import Extraction, Indicator
+
+
+class IndicatorRecord(Protocol):
+    """Structural type of the optional pydantic indicator model."""
+
+    type: str
+    value: str
+    normalized: str
+    raw: str
+    fingerprint: str
+    confidence: float
+    occurrences: int
+    valid: bool | None
+
+
+def to_pydantic(indicator: Indicator) -> IndicatorRecord:
+    """Convert one indicator to a pydantic model.
+
+    Args:
+        indicator: Indicator to convert.
+
+    Returns:
+        A pydantic ``BaseModel`` instance with the indicator fields.
+
+    Raises:
+        OptionalDependencyError: pydantic is not installed.
+    """
+
+    validate = _validator()
+    return cast(IndicatorRecord, validate(indicator_to_dict(indicator)))
+
+
+def extraction_to_pydantic(result: Extraction) -> list[IndicatorRecord]:
+    """Convert every indicator in an extraction.
+
+    Args:
+        result: Extraction to convert.
+
+    Returns:
+        One pydantic model per indicator.
+
+    Raises:
+        OptionalDependencyError: pydantic is not installed.
+    """
+
+    return [to_pydantic(indicator) for indicator in result]
+
+
+@lru_cache(maxsize=1)
+def _validator() -> Callable[[object], object]:
+    try:
+        module = importlib.import_module("pydantic")
+    except ImportError as exc:
+        raise OptionalDependencyError(
+            "pydantic is required for this adapter. "
+            "Install it with: pip install 'qarbaal[pydantic]'"
+        ) from exc
+    factory = getattr(module, "create_model", None)
+    if not callable(factory):
+        raise OptionalDependencyError("pydantic.create_model is unavailable")
+    create = cast(Callable[..., type[object]], factory)
+    model = create(
+        "QarbaalIndicator",
+        type=(str, ...),
+        value=(str, ...),
+        normalized=(str, ...),
+        raw=(str, ...),
+        tags=(list[str], ...),
+        fingerprint=(str, ...),
+        valid=(bool | None, ...),
+        confidence=(float, ...),
+        validation_notes=(list[str], ...),
+        occurrences=(int, ...),
+        sources=(list[str], ...),
+        sightings=(list[dict[str, object]], ...),
+        enrichment=(dict[str, object], ...),
+        pivots=(list[dict[str, str]], ...),
+    )
+    validate = getattr(model, "model_validate", None)
+    if not callable(validate):
+        raise OptionalDependencyError("pydantic model has no model_validate")
+    return cast(Callable[[object], object], validate)