txt2stix 0.0.4__py3-none-any.whl

txt2stix/includes/helpers/windows_registry_key_prefix.txt

@@ -0,0 +1,12 @@
+HKEY_CLASSES_ROOT
+HKCR
+HKEY_CURRENT_USER
+HKCU
+HKEY_LOCAL_MACHINE
+HKLM
+HKEY_USERS
+HKU
+HKEY_CURRENT_CONFIG
+HKCC
+HKEY_PERFORMANCE_DATA
+HKEY_DYN_DATA

txt2stix/includes/lookups/_README.md

@@ -0,0 +1,11 @@
+The following script can be run after importing the data -- these scripts will do this for you: https://github.com/muchdogesec/stix2arango/blob/main/utilities/README.md
+
+Make sure the versions imported, match those in the searches below.
+
+```shell
+pip3 install python-arango
+```
+
+```shell
+python3 includes/lookups/_generate_lookups.py
+```

txt2stix/includes/lookups/_generate_lookups.py

@@ -0,0 +1,247 @@
+import os
+from arango import ArangoClient
+
+# Connect to ArangoDB
+client = ArangoClient()
+db = client.db('ctibutler_database', username='root', password='')
+
+# Get the directory where the script is located
+script_dir = os.path.dirname(os.path.abspath(__file__))
+
+# Define queries and output files
+queries = {
+    "mitre_cwe_id_v4_15.txt":
+      """
+        FOR doc IN mitre_cwe_vertex_collection
+          FILTER doc._stix2arango_note == "version=4_15"
+          AND IS_ARRAY(doc.external_references)
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND doc.type == "weakness"
+          AND doc.name != null
+          AND !CONTAINS(doc.name, "DEPRECATED:")
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "cwe"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_cwe_name_v4_15.txt":
+      """
+        FOR doc IN mitre_cwe_vertex_collection
+          FILTER doc._stix2arango_note == "version=4_15"
+          AND IS_ARRAY(doc.external_references)
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND doc.type == "weakness"
+          AND doc.name != null
+          AND !CONTAINS(doc.name, "DEPRECATED:")
+          RETURN doc.name
+      """,
+    "mitre_capec_id_v3_9.txt":
+      """
+        FOR doc IN mitre_capec_vertex_collection
+          FILTER doc._stix2arango_note == "version=3_9"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND doc.type != "course-of-action"
+          AND doc.name != null
+          AND !CONTAINS(doc.name, "DEPRECATED:")
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "capec"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_capec_name_v3_9.txt":
+      """
+        FOR doc IN mitre_capec_vertex_collection
+          FILTER doc._stix2arango_note == "version=3_9"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND doc.type != "course-of-action"
+          AND doc.name != null
+          AND !CONTAINS(doc.name, "DEPRECATED:")
+          RETURN doc.name
+      """,
+    "mitre_attack_enterprise_id_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_enterprise_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "mitre-attack"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_attack_enterprise_name_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_enterprise_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          RETURN doc.name
+      """,
+    "mitre_attack_enterprise_aliases_v16_0.txt":
+      """
+        FOR alias IN UNIQUE(
+          FLATTEN(
+            FOR doc IN mitre_attack_enterprise_vertex_collection
+              FILTER doc._stix2arango_note == "version=16_0"
+              AND doc.type != "x-mitre-matrix"
+              AND doc.x_mitre_deprecated != true
+              AND doc.revoked != true
+              LET combined_aliases = APPEND(
+                doc.aliases ? doc.aliases : [],
+                doc.x_mitre_aliases ? doc.x_mitre_aliases : []
+              )
+              FILTER LENGTH(combined_aliases) > 0
+              RETURN combined_aliases
+          )
+        )
+        RETURN alias
+      """,
+    "mitre_attack_ics_id_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_ics_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "mitre-attack"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_attack_ics_name_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_ics_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          RETURN doc.name
+      """,
+    "mitre_attack_ics_aliases_v16_0.txt":
+      """
+        FOR alias IN UNIQUE(
+          FLATTEN(
+            FOR doc IN mitre_attack_ics_vertex_collection
+              FILTER doc._stix2arango_note == "version=16_0"
+              AND doc.type != "x-mitre-matrix"
+              AND doc.x_mitre_deprecated != true
+              AND doc.revoked != true
+              LET combined_aliases = APPEND(
+                doc.aliases ? doc.aliases : [],
+                doc.x_mitre_aliases ? doc.x_mitre_aliases : []
+              )
+              FILTER LENGTH(combined_aliases) > 0
+              RETURN combined_aliases
+          )
+        )
+        RETURN alias
+      """,
+    "mitre_attack_mobile_id_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_mobile_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "mitre-attack"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_attack_mobile_name_v16_0.txt":
+      """
+        FOR doc IN mitre_attack_mobile_vertex_collection
+          FILTER doc._stix2arango_note == "version=16_0"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          RETURN doc.name
+      """,
+    "mitre_attack_mobile_aliases_v16_0.txt":
+      """
+        FOR alias IN UNIQUE(
+          FLATTEN(
+            FOR doc IN mitre_attack_mobile_vertex_collection
+              FILTER doc._stix2arango_note == "version=16_0"
+              AND doc.type != "x-mitre-matrix"
+              AND doc.x_mitre_deprecated != true
+              AND doc.revoked != true
+              LET combined_aliases = APPEND(
+                doc.aliases ? doc.aliases : [],
+                doc.x_mitre_aliases ? doc.x_mitre_aliases : []
+              )
+              FILTER LENGTH(combined_aliases) > 0
+              RETURN combined_aliases
+          )
+        )
+        RETURN alias
+      """,
+    "mitre_atlas_id_v4_5_2.txt":
+      """
+        FOR doc IN mitre_atlas_vertex_collection
+          FILTER doc._stix2arango_note == "version=4_5_2"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "mitre-atlas"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+      """,
+    "mitre_atlas_name_v4_5_2.txt":
+      """
+        FOR doc IN mitre_atlas_vertex_collection
+          FILTER doc._stix2arango_note == "version=4_5_2"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          RETURN doc.name
+      """,
+    "disarm_id_v1_5.txt":
+      """
+        FOR doc IN disarm_vertex_collection
+          FILTER doc._stix2arango_note == "version=1_5"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          AND IS_ARRAY(doc.external_references)
+          FOR reference IN doc.external_references
+            FILTER reference.source_name == "DISARM"
+            SORT reference.external_id ASC
+            RETURN reference.external_id
+    """,
+    "disarm_name_v1_5.txt":
+      """
+        FOR doc IN disarm_vertex_collection
+          FILTER doc._stix2arango_note == "version=1_5"
+          AND doc.type != "x-mitre-matrix"
+          AND doc.x_mitre_deprecated != true
+          AND doc.revoked != true
+          RETURN doc.name
+      """
+}
+
+# Execute each query and save the results in the script's directory
+for filename, query in queries.items():
+    cursor = db.aql.execute(query)
+    results = [str(doc) for doc in cursor]
+    
+    # Full path for each output file
+    filepath = os.path.join(script_dir, filename)
+    
+    # Write results to a text file with each result on a new line
+    with open(filepath, 'w') as f:
+        f.write("\n".join(results))
+    
+    print(f"Results saved to {filepath}")

txt2stix/includes/lookups/attack_pattern.txt

@@ -0,0 +1 @@
+Content Spoofer

txt2stix/includes/lookups/campaign.txt

@@ -0,0 +1 @@
+Inspector-1

txt2stix/includes/lookups/country_iso3166_alpha2.txt

@@ -0,0 +1,249 @@
+AD
+AE
+AF
+AG
+AI
+AL
+AM
+AO
+AQ
+AR
+AS
+AT
+AU
+AW
+AX
+AZ
+BA
+BB
+BD
+BE
+BF
+BG
+BH
+BI
+BJ
+BL
+BM
+BN
+BO
+BQ
+BR
+BS
+BT
+BV
+BW
+BY
+BZ
+CA
+CC
+CD
+CF
+CG
+CH
+CI
+CK
+CL
+CM
+CN
+CO
+CR
+CU
+CV
+CW
+CX
+CY
+CZ
+DE
+DJ
+DK
+DM
+DO
+DZ
+EC
+EE
+EG
+EH
+ER
+ES
+ET
+FI
+FJ
+FK
+FM
+FO
+FR
+GA
+GB
+GD
+GE
+GF
+GG
+GH
+GI
+GL
+GM
+GN
+GP
+GQ
+GR
+GS
+GT
+GU
+GW
+GY
+HK
+HM
+HN
+HR
+HT
+HU
+ID
+IE
+IL
+IM
+IN
+IO
+IQ
+IR
+IS
+IT
+JE
+JM
+JO
+JP
+KE
+KG
+KH
+KI
+KM
+KN
+KP
+KR
+KW
+KY
+KZ
+LA
+LB
+LC
+LI
+LK
+LR
+LS
+LT
+LU
+LV
+LY
+MA
+MC
+MD
+ME
+MF
+MG
+MH
+MK
+ML
+MM
+MN
+MO
+MP
+MQ
+MR
+MS
+MT
+MU
+MV
+MW
+MX
+MY
+MZ
+NA
+NC
+NE
+NF
+NG
+NI
+NL
+NO
+NP
+NR
+NU
+NZ
+OM
+PA
+PE
+PF
+PG
+PH
+PK
+PL
+PM
+PN
+PR
+PS
+PT
+PW
+PY
+QA
+RE
+RO
+RS
+RU
+RW
+SA
+SB
+SC
+SD
+SE
+SG
+SH
+SI
+SJ
+SK
+SL
+SM
+SN
+SO
+SR
+SS
+ST
+SV
+SX
+SY
+SZ
+TC
+TD
+TF
+TG
+TH
+TJ
+TK
+TL
+TM
+TN
+TO
+TR
+TT
+TV
+TW
+TZ
+UA
+UG
+UM
+US
+UY
+UZ
+VA
+VC
+VE
+VG
+VI
+VN
+VU
+WF
+WS
+YE
+YT
+ZA
+ZM
+ZW

txt2stix/includes/lookups/course_of_action.txt

@@ -0,0 +1 @@
+Patch server