txt2detection 1.0.9__py3-none-any.whl → 1.0.11__py3-none-any.whl

txt2detection/__main__.py

@@ -258,7 +258,7 @@ def run_txt2detection(
     **kwargs,
 ) -> Bundler:
     if (
-        kwargs.get("sigma_file") != "sigma_file"
+        not kwargs.get("sigma_file")
         or ai_create_attack_flow
         or ai_create_attack_navigator_layer
     ):

txt2detection/attack_flow.py

@@ -9,14 +9,12 @@ from .bundler import Bundler
 from .ai_extractor.base import BaseAIExtractor
 from .models import UUID_NAMESPACE
 from stix2extensions.attack_action import AttackAction, AttackFlow
-from stix2extensions._extensions import attack_flow_ExtensionDefinitionSMO
-
 
 def parse_flow(report, flow: AttackFlowList, techniques, tactics):
     logging.info(f"flow.success = {flow.success}")
     if not flow.success:
         return []
-    objects = [report, attack_flow_ExtensionDefinitionSMO]
+    objects = [report]
     for domain in ["enterprise-attack", "mobile-attack", "ics-attack"]:
         flow_objects = parse_domain_flow(report, flow, techniques, tactics, domain)
         objects.extend(flow_objects)

txt2detection/bundler.py

@@ -42,6 +42,7 @@ class Bundler:
     uuid = None
     id_map = dict()
     data: DataContainer
+    ATTACK_FLOW_SMO_URL = "https://github.com/muchdogesec/stix2extensions/raw/refs/heads/main/remote-definitions/attack-flow.json"
     # https://raw.githubusercontent.com/muchdogesec/stix4doge/refs/heads/main/objects/identity/txt2detection.json
     default_identity = Identity(
         **{
@@ -361,6 +362,23 @@ class Bundler:
         for d in container.detections:
             self.add_rule_indicator(d)
 
+    
+    @property
+    def flow_objects(self):
+        return self._flow_objects
+
+    @flow_objects.setter
+    def flow_objects(self, objects):
+        smo_objects = requests.get(self.ATTACK_FLOW_SMO_URL).json()["objects"]
+        objects.extend(smo_objects)
+        for obj in objects:
+            if obj["id"] == self.report.id:
+                continue
+            is_report_object = obj["type"] not in ["extension-definition", "identity"]
+            self.add_ref(obj, append_report=is_report_object)
+        self._flow_objects = objects
+
+
 
 def make_logsouce_string(source: dict):
     d = [

{txt2detection-1.0.9.dist-info → txt2detection-1.0.11.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2detection
-Version: 1.0.9
+Version: 1.0.11
 Summary: A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2detection
 Project-URL: Issues, https://github.com/muchdogesec/txt2detection/issues

{txt2detection-1.0.9.dist-info → txt2detection-1.0.11.dist-info}/RECORD

@@ -1,7 +1,7 @@
 txt2detection/__init__.py,sha256=Fc460P0q_eb2u3Xc89z-fwl-4ai3jrPqPNVwJQYNkNQ,89
-txt2detection/__main__.py,sha256=s5XcIctE59ALjys6Y8lRIqS_pQWi1mlNo2gyG8_XS5s,11622
-txt2detection/attack_flow.py,sha256=1Ns98ZEoiN8kH-iSo7d6zYtplm11QkhPQAvSZsW4WXQ,8853
-txt2detection/bundler.py,sha256=eHyr6jlnd4ZvynHkyy5Hposkp_XqEAxEwGzlViSq1xU,13319
+txt2detection/__main__.py,sha256=cZchD4lx_YscSkqVscYqDboZftsBCUfskaP4585QdI0,11610
+txt2detection/attack_flow.py,sha256=x6GhDZZ8xOzugfMELvHvrhclcIqozGIt9_mzyr2KKnA,8741
+txt2detection/bundler.py,sha256=eGCIwLY0J_SVyOI_1IFsm_8RgvaE_32t5MIc_UyJwm0,13994
 txt2detection/credential_checker.py,sha256=NuKk7WlDshtdpGecxY1exoi4fUHCygunPH2lZ20oEA8,2598
 txt2detection/models.py,sha256=_-sR03FEWI46OUZdL7U0tibNn909B0NU9LWNzopBtiY,12888
 txt2detection/observables.py,sha256=RxgJchvk6_Z2pBxJ6MAGsx00gj8TyRt9W2BTQTb1F9o,6762
@@ -17,8 +17,8 @@ txt2detection/ai_extractor/openrouter.py,sha256=rL-SnzRhzrCnPJGLxbTlRyxU0NAw42Rm
 txt2detection/ai_extractor/prompts.py,sha256=xI82PelsTidnRzi5wnNbEC4lmkio92YUDd8SZu4CQiE,10961
 txt2detection/ai_extractor/utils.py,sha256=SUxyPhkGp5yDbX_H_E018i93R8IbyLsQ00PIBDecfuc,540
 txt2detection/config/detection_languages.yaml,sha256=dgQUJPxhDRJ_IiFEFOiH0yhEer3SkFSIhY4pS3BsX2c,287
-txt2detection-1.0.9.dist-info/METADATA,sha256=UHkUnaL9wEt78RNw0EmQenodg2qxZ3gsTDkmVC2W7IE,15869
-txt2detection-1.0.9.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-txt2detection-1.0.9.dist-info/entry_points.txt,sha256=ep_rLlS2r1-kKE7S3iKf3SVwbCU9-FZhU9zUebitw7A,62
-txt2detection-1.0.9.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
-txt2detection-1.0.9.dist-info/RECORD,,
+txt2detection-1.0.11.dist-info/METADATA,sha256=5sPLzlTTug4AOTTk6YH8G7EjfFheA0pLaEKlWUTtMek,15870
+txt2detection-1.0.11.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+txt2detection-1.0.11.dist-info/entry_points.txt,sha256=ep_rLlS2r1-kKE7S3iKf3SVwbCU9-FZhU9zUebitw7A,62
+txt2detection-1.0.11.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
+txt2detection-1.0.11.dist-info/RECORD,,