txt2stix 1.1.13__tar.gz → 1.1.14__tar.gz

{txt2stix-1.1.13 → txt2stix-1.1.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2stix
-Version: 1.1.13
+Version: 1.1.14
 Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
 Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues

{txt2stix-1.1.13 → txt2stix-1.1.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "txt2stix"
-version = "1.1.13"
+version = "1.1.14"
 authors = [{ name = "dogesec" }]
 maintainers = [{ name = "dogesec" }]
 description = "txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle."

{txt2stix-1.1.13 → txt2stix-1.1.14}/tests/src/test_indicator.py

@@ -1,3 +1,4 @@
+import json
 from pathlib import PurePosixPath, PureWindowsPath
 import pytest
 from unittest import mock
@@ -12,6 +13,7 @@ from txt2stix.indicator import (
     BadDataException,
 )
 from stix2 import HashConstant
+from stix2.serialization import serialize as serialize_stix
 
 from txt2stix.bundler import txt2stixBundler
 from datetime import datetime
@@ -379,6 +381,21 @@ all_extractors = get_all_extractors()
             },
             id="payment-card, with issuer-name",
         ),
+        ## identity
+        pytest.param(
+            "My Identity 1",
+            "ai_identity",
+            {"identity--919283f8-8498-542b-a532-6bb2003282aa"},
+            {"identity--919283f8-8498-542b-a532-6bb2003282aa"},
+            id="identity-i",
+        ),
+        pytest.param(
+            "My Identity 2",
+            "ai_identity",
+            {"identity--2e0aadad-9b58-5c8c-bef6-4c258b35f319"},
+            {"identity--2e0aadad-9b58-5c8c-bef6-4c258b35f319"},
+            id="identity-ii",
+        ),
     ],
 )
 def test_build_observables(value, extractor_name, expected_objects, expected_rels):
@@ -391,6 +408,44 @@ def test_build_observables(value, extractor_name, expected_objects, expected_rel
     assert {id for id in relationships} == set(expected_rels)
 
 
+def test_identity_deterministic():
+    value = "My Identity 1"
+    extractor = all_extractors["ai_identity"]
+    indicator = mock_bundler.new_indicator(extractor, extractor.stix_mapping, value)
+    objects, relationships = build_observables(
+        mock_bundler, extractor.stix_mapping, indicator, value, extractor
+    )
+    assert len(objects) == 1
+    assert len(relationships) == 1
+    obj = objects[0]
+    assert obj["id"] == relationships[0]
+    obj = json.loads(serialize_stix(obj))
+    assert obj == {
+        "type": "identity",
+        "spec_version": "2.1",
+        "id": "identity--919283f8-8498-542b-a532-6bb2003282aa",
+        "created_by_ref": "identity--f92e15d9-6afc-5ae2-bb3e-85a1fd83a3b5",
+        "created": "2020-01-01T00:00:00.000Z",
+        "modified": "2020-01-01T00:00:00.000Z",
+        "name": "My Identity 1",
+        "identity_class": "unspecified",
+        "external_references": [
+            {
+                "source_name": "txt2stix_report_id",
+                "external_id": "4719f590-f54e-5589-88b0-cdeeac908a51",
+            },
+            {
+                "source_name": "txt2stix_extraction_type",
+                "description": "ai_identity_1.0.0",
+            },
+        ],
+        "object_marking_refs": [
+            "marking-definition--e828b379-4e03-4974-9ac4-e53a884c97c1",
+            "marking-definition--f92e15d9-6afc-5ae2-bb3e-85a1fd83a3b5",
+        ],
+    }
+
+
 @pytest.mark.parametrize(
     "extractor_name",
     {

{txt2stix-1.1.13 → txt2stix-1.1.14}/txt2stix/indicator.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
+from datetime import UTC, datetime
 import os
 import re
+import uuid
 from stix2.parsing import dict_to_stix2
 from stix2 import HashConstant, File
 from stix2.v21.vocab import HASHING_ALGORITHM
@@ -24,7 +26,7 @@ if TYPE_CHECKING:
 
 # from schwifty import IBAN
 
-from .common import MinorException
+from .common import UUID_NAMESPACE, MinorException
 
 from .retriever import retrieve_stix_objects
 
@@ -675,11 +677,19 @@ def _build_observables(
             )
         )
 
+    _id_part = str(
+        uuid.uuid5(
+            UUID_NAMESPACE,
+            f"txt2stix+{extracted_value}",
+        )
+    )
+
     if stix_mapping == "attack-pattern":
         stix_objects = [
             dict_to_stix2(
                 {
                     "type": "attack-pattern",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -695,6 +705,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "campaign",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -711,6 +722,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "course-of-action",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -727,6 +739,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "infrastructure",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -744,6 +757,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "intrusion-set",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -760,6 +774,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "malware",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -778,6 +793,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "threat-actor",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -795,6 +811,7 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "tool",
+                    # "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
                     "created": indicator["created"],
@@ -814,8 +831,9 @@ def _build_observables(
                     "type": "identity",
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": datetime(2020, 1, 1, tzinfo=UTC),
+                    "modified": datetime(2020, 1, 1, tzinfo=UTC),
+                    "id": "identity--" + _id_part,
                     "name": extracted_value,
                     "identity_class": "unspecified",
                     "object_marking_refs": indicator["object_marking_refs"],