txt2stix 1.0.7__py3-none-any.whl → 1.0.9__py3-none-any.whl

txt2stix/attack_flow.py

@@ -16,15 +16,26 @@ def parse_flow(report, flow: AttackFlowList, techniques, tactics):
     logging.info(f"flow.success = {flow.success}")
     if not flow.success:
         return []
-    flow_objects = [report, attack_flow_ExtensionDefinitionSMO]
+    objects = [report, attack_flow_ExtensionDefinitionSMO]
+    for domain in ["enterprise-attack", "mobile-attack", "ics-attack"]:
+        flow_objects = parse_domain_flow(report, flow, techniques, tactics, domain)
+        objects.extend(flow_objects)
+    return objects
+
+def parse_domain_flow(report, flow: AttackFlowList, techniques, tactics, domain):
+    flow_objects = []
+    flow_obj = None
     last_action = None
     for i, item in enumerate(flow.items):
         try:
             technique = techniques[item.attack_technique_id]
+            if technique["domain"] != domain:
+                continue
             tactic_id = technique["possible_tactics"][
                 flow.tactic_mapping[item.attack_technique_id]
             ]
             technique_obj = technique["stix_obj"]
+
             tactic_obj = tactics[technique["domain"]][tactic_id]
             action_obj = AttackAction(
                 **{
@@ -40,16 +51,16 @@ def parse_flow(report, flow: AttackFlowList, techniques, tactics):
                 allow_custom=True,
             )
             action_obj.effect_refs.clear()
-            if i == 0:
+            if not flow_obj:
                 flow_obj = {
                     "type": "attack-flow",
-                    "id": report.id.replace("report", "attack-flow"),
+                    "id": "attack-flow--"+str(uuid.uuid5(UUID_NAMESPACE, f"attack-flow+{domain}+{report.id}")),
                     "spec_version": "2.1",
                     "created": report.created,
                     "modified": report.modified,
                     "created_by_ref": report.created_by_ref,
                     "start_refs": [action_obj["id"]],
-                    "name": report.name,
+                    "name": f"[{domain.split('-')[0].upper()}] {report.name}",
                     "description": report.description,
                     "scope": "malware",
                     "external_references": report.external_references,
@@ -61,7 +72,7 @@ def parse_flow(report, flow: AttackFlowList, techniques, tactics):
                         type="relationship",
                         spec_version="2.1",
                         id="relationship--"
-                        + str(uuid.uuid5(UUID_NAMESPACE, f"attack-flow+{report.id}")),
+                        + str(uuid.uuid5(UUID_NAMESPACE, f"attack-flow+{report.id}+{flow_obj['id']}")),
                         created_by_ref=report.created_by_ref,
                         created=report.created,
                         modified=report.modified,
@@ -147,7 +158,7 @@ def get_techniques_from_extracted_objects(objects: dict, tactics: dict):
     return techniques
 
 
-def create_navigator_layer(report, summary, flow: AttackFlowList, techniques):
+def create_navigator_layer(report, summary, flow: AttackFlowList, techniques, tactics):
     domains = {}
     comments = {item.attack_technique_id: item.description for item in flow.items}
     for technique in techniques.values():
@@ -170,7 +181,11 @@ def create_navigator_layer(report, summary, flow: AttackFlowList, techniques):
     for domain, domain_techniques in domains.items():
         retval.append(
             {
-                "version": "4.5",
+                "versions": {
+                    "layer": "4.5",
+                    "attack": tactics[domain]['version'],
+                    "navigator": "5.1.0"
+                },
                 "name": report.name,
                 "domain": domain,
                 "description": summary,
@@ -220,6 +235,6 @@ def extract_attack_flow_and_navigator(
 
     if ai_create_attack_navigator_layer:
         navigator = create_navigator_layer(
-            bundler.report, bundler.summary, flow, techniques
+            bundler.report, bundler.summary, flow, techniques, tactics
         )
     return flow, navigator

txt2stix/retriever.py

@@ -28,8 +28,9 @@ class STIXObjectRetriever:
     
     def get_attack_tactics(self, matrix):
         endpoint = urljoin(self.api_root, f"v1/attack-{matrix}/objects/?attack_type=Tactic")
+        version_url = urljoin(self.api_root, f'v1/attack-{matrix}/versions/installed/')
         tactics = self._retrieve_objects(endpoint)
-        retval = {}
+        retval = dict(version=self.session.get(version_url).json()['latest'])
         for tac in tactics:
             retval[tac['x_mitre_shortname']] = tac
             retval[tac['external_references'][0]['external_id']] = tac

{txt2stix-1.0.7.dist-info → txt2stix-1.0.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2stix
-Version: 1.0.7
+Version: 1.0.9
 Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
 Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues

{txt2stix-1.0.7.dist-info → txt2stix-1.0.9.dist-info}/RECORD

@@ -1,12 +1,12 @@
 txt2stix/__init__.py,sha256=Sm_VT913IFuAZ6dJEdVz3baPwC5VYtHySVfBAOUG92w,803
-txt2stix/attack_flow.py,sha256=WnhihbY_ltWOXrmzigTHIwj1pzSIQqKpu2sPe2M465k,8489
+txt2stix/attack_flow.py,sha256=FA5mRf4iVe9E6e_WfGF9PK6MTz8f3UhvDKjO_PDFHso,9164
 txt2stix/bundler.py,sha256=kqUNW9_jktuMyWSkoAa-ydZY-L5gzSSkthb7OdhUiKo,16854
 txt2stix/common.py,sha256=ISnGNKqJPE1EcfhL-x_4G18mcwt1urmorkW-ru9kV-0,585
 txt2stix/credential_checker.py,sha256=eWDP-jY3-jm8zI0JMoUcyoQZ_JqPNfCIr_HAO8nVYz0,3044
 txt2stix/extractions.py,sha256=_tlsqYHhfAoV-PJzxRHysrX47uxCsMlSg7PQWxww1u0,2171
 txt2stix/indicator.py,sha256=c6S0xx0K8JM-PT_Qd1PlN_ZlDXdnEwiRS8529iUp3yg,30774
 txt2stix/lookups.py,sha256=h42YVtYUkWZm6ZPv2h5hHDHDzDs3yBqrT_T7pj2MDZI,2301
-txt2stix/retriever.py,sha256=JHR_bzj442-BZSc1FAE7zMisP-n--Ax54P_JclIVTsQ,5583
+txt2stix/retriever.py,sha256=biRSRwYsZoSvR758y4OFONjfrEMcxgj1PLHFLFydoSU,5729
 txt2stix/stix.py,sha256=9nXD9a2dCY4uaatl-mlIA1k3srwQBhGW-tUSho3iYe0,30
 txt2stix/txt2stix.py,sha256=b16h8BCSerZrq7PWjXkUZB4WXkDCUDMru1LDJeIXCHo,18587
 txt2stix/utils.py,sha256=n6mh4t9ZRJ7iT4Jvp9ai_dfCXjgXNcRtF_zXO7nkpnk,3304
@@ -113,8 +113,8 @@ txt2stix/includes/lookups/threat_actor.txt,sha256=QfDO9maQuqKBgW_Sdd7VGv1SHZ9Ra-
 txt2stix/includes/lookups/tld.txt,sha256=-MEgJea2NMG_KDsnc4BVvI8eRk5Dm93L-t8SGYx5wMo,8598
 txt2stix/includes/lookups/tool.txt,sha256=HGKG6JpUE26w6ezzSxOjBkp15UpSaB7N-mZ_NU_3G7A,6
 txt2stix/includes/tests/test_cases.yaml,sha256=QD1FdIunpPkOpsn6wJRqs2vil_hv8OSVaqUp4a96aZg,22247
-txt2stix-1.0.7.dist-info/METADATA,sha256=pddAmuB6pv_PjY8CAf2fgiyXKQZH1jn738gYXrN_HwA,15482
-txt2stix-1.0.7.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-txt2stix-1.0.7.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
-txt2stix-1.0.7.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
-txt2stix-1.0.7.dist-info/RECORD,,
+txt2stix-1.0.9.dist-info/METADATA,sha256=j_usZnd_eI4GYtyvuOKw-9untmHdSLsP9fBs35w71x4,15482
+txt2stix-1.0.9.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+txt2stix-1.0.9.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
+txt2stix-1.0.9.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
+txt2stix-1.0.9.dist-info/RECORD,,