txt2stix 1.1.15__py3-none-any.whl → 1.2.1__py3-none-any.whl

txt2stix/includes/extractions/ai/config.yaml

@@ -778,7 +778,23 @@ ai_country:
   type: ai
   dogesec_web: true
   name: 'Country'
-  description: 'Will extract countries, turn into two digit country codes, and import location object from CTI Butler.'
+  description: 'Will extract countries, turn into two digit country codes, and import location (and all related regions and subregions) object from CTI Butler.'
+  notes: 'lookup_country_alpha2 legacy extraction also exists if you cannot use AI'
+  created: 2020-01-01
+  modified: 2020-01-01
+  created_by: dogesec
+  version: 1.0.0
+  prompt_base: 'Extract all countries described in the text, including countries printed as IS0-3166 Alpha2 and Alpha3 codes.'
+  prompt_helper: 'If you are unsure, you can read more about the standard here: https://www.iso.org/iso-3166-country-codes.html'
+  prompt_conversion: 'Convert all country extractions to their corresponding IS0-3166 Alpha2 codes.'
+  test_cases: ai_country
+  stix_mapping: ctibutler-location-with-regions
+
+ai_country_only:
+  type: ai
+  dogesec_web: true
+  name: 'Country only'
+  description: 'Will extract countries, turn into two digit country codes, and import location (without regions and subregions) object from CTI Butler.'
   notes: 'lookup_country_alpha2 legacy extraction also exists if you cannot use AI'
   created: 2020-01-01
   modified: 2020-01-01

txt2stix/includes/extractions/lookup/config.yaml

@@ -5,8 +5,23 @@
 lookup_country_alpha2:
   type: lookup
   dogesec_web: false
-  name: 'Country Alpha2'
-  description: 'Extracts countries using ISO 3166-1 alpha2 codes'
+  name: 'Country Alpha2 (with regions)'
+  description: 'Extracts countries using ISO 3166-1 alpha2 codes (will create relationships to regions and subregions).'
+  notes: 'RECOMMENDED FOR BETTER ACCURACY: Use ai_country. This extractor is very dumb e.g the words `is` and `in` will result in extractions for Iceland and India'
+  file: 'lookups/country_iso3166_alpha2.txt'
+  created: 2020-01-01
+  modified:  2020-01-01
+  created_by: dogesec
+  version: 1.0.0
+  test_cases: generic_country_alpha2
+  stix_mapping: ctibutler-location-with-regions
+
+
+lookup_country_alpha2_country_only:
+  type: lookup
+  dogesec_web: false
+  name: 'Country Alpha2 (without regions)'
+  description: 'Extracts countries using ISO 3166-1 alpha2 codes (will not create relationships).'
   notes: 'RECOMMENDED FOR BETTER ACCURACY: Use ai_country. This extractor is very dumb e.g the words `is` and `in` will result in extractions for Iceland and India'
   file: 'lookups/country_iso3166_alpha2.txt'
   created: 2020-01-01

txt2stix/indicator.py

@@ -106,7 +106,10 @@ def _build_observables(
 ):
     retrieved_objects = retrieve_stix_objects(stix_mapping, extracted_value)
     if retrieved_objects:
-        return retrieved_objects, [sdo["id"] for sdo in retrieved_objects]
+        relatable = [sdo["id"] for sdo in retrieved_objects]
+        if 'location' in stix_mapping:
+            relatable = [retrieved_objects[0]['id']]
+        return retrieved_objects, relatable
     if retrieved_objects == []:
         logger.warning(
             f"could not find `{stix_mapping}` with id=`{extracted_value}` in remote"
@@ -623,7 +626,7 @@ def _build_observables(
         extracted_value = extracted_value.replace("-", "").replace(" ", "")
 
         country_code, bank_code = get_iban_details(extracted_value)
-        location = retrieve_stix_objects("location", country_code)[0]
+        location = retrieve_stix_objects("ctibutler-location", country_code)[0]
         stix_objects.append(location)
 
         bank_acc = dict_to_stix2(
@@ -683,17 +686,18 @@ def _build_observables(
             f"txt2stix+{extracted_value}",
         )
     )
+    _date = datetime(2020, 1, 1, tzinfo=UTC)
 
     if stix_mapping == "attack-pattern":
         stix_objects = [
             dict_to_stix2(
                 {
                     "type": "attack-pattern",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "external_references": indicator["external_references"],
                 }
@@ -705,11 +709,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "campaign",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "object_marking_refs": indicator["object_marking_refs"],
                     "external_references": indicator["external_references"],
@@ -722,11 +726,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "course-of-action",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "object_marking_refs": indicator["object_marking_refs"],
                     "external_references": indicator["external_references"],
@@ -739,11 +743,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "infrastructure",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "infrastructure_types": ["unknown"],
                     "object_marking_refs": indicator["object_marking_refs"],
@@ -757,11 +761,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "intrusion-set",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "object_marking_refs": indicator["object_marking_refs"],
                     "external_references": indicator["external_references"],
@@ -774,11 +778,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "malware",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "malware_types": ["unknown"],
                     "is_family": True,
@@ -793,11 +797,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "threat-actor",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "threat_actor_types": "unknown",
                     "object_marking_refs": indicator["object_marking_refs"],
@@ -811,11 +815,11 @@ def _build_observables(
             dict_to_stix2(
                 {
                     "type": "tool",
-                    # "id": stix_mapping + "--" + _id_part,
+                    "id": stix_mapping + "--" + _id_part,
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": indicator["created"],
-                    "modified": indicator["modified"],
+                    "created": _date,
+                    "modified": _date,
                     "name": extracted_value,
                     "tool_types": "unknown",
                     "object_marking_refs": indicator["object_marking_refs"],
@@ -831,8 +835,8 @@ def _build_observables(
                     "type": "identity",
                     "spec_version": "2.1",
                     "created_by_ref": indicator["created_by_ref"],
-                    "created": datetime(2020, 1, 1, tzinfo=UTC),
-                    "modified": datetime(2020, 1, 1, tzinfo=UTC),
+                    "created": _date,
+                    "modified": _date,
                     "id": "identity--" + _id_part,
                     "name": extracted_value,
                     "identity_class": "unspecified",

txt2stix/retriever.py

@@ -69,6 +69,10 @@ class STIXObjectRetriever:
         return self._retrieve_objects(
             urljoin(self.api_root, f"v1/location/objects/?alpha2_code={id}")
         )
+    
+    def get_location_bundle(self, id):
+        endpoint = urljoin(self.api_root, f"v1/location/objects/{id}/bundle/?types=location,relationship")
+        return self._retrieve_objects(endpoint, key="objects")
 
     def get_objects_by_name(self, name, type):
         return self._retrieve_objects(
@@ -122,6 +126,10 @@ def _retrieve_stix_objects(host, knowledge_base, filter_value):
             return retreiver.retrieve_object_by_id(filter_value, "cpe")
         case "location":
             return retreiver.get_location_objects(filter_value)
+        case "location-with-regions":
+            locations = retreiver.get_location_bundle(filter_value)
+            locations.sort(key=lambda x: int(x.get('country') == filter_value), reverse=True)
+            return locations
 
         ### ATT&CK by Name
         case "mitre-attack-enterprise-name":
@@ -162,8 +170,6 @@ def _retrieve_stix_objects(host, knowledge_base, filter_value):
 
 def retrieve_stix_objects(stix_mapping: str, filter_value, host=None):
     knowledge_base = stix_mapping
-    if stix_mapping in ["location"]:
-        host = "ctibutler"
     if not host:
         host, _, knowledge_base = stix_mapping.partition("-")
     try:

{txt2stix-1.1.15.dist-info → txt2stix-1.2.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2stix
-Version: 1.1.15
+Version: 1.2.1
 Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
 Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues

{txt2stix-1.1.15.dist-info → txt2stix-1.2.1.dist-info}/RECORD

@@ -4,9 +4,9 @@ txt2stix/bundler.py,sha256=GmpWW9ek4iFZdEIyjVSpd9RnmyeNsZJOpnax5Tt0uT0,16748
 txt2stix/common.py,sha256=ISnGNKqJPE1EcfhL-x_4G18mcwt1urmorkW-ru9kV-0,585
 txt2stix/credential_checker.py,sha256=eWDP-jY3-jm8zI0JMoUcyoQZ_JqPNfCIr_HAO8nVYz0,3044
 txt2stix/extractions.py,sha256=_tlsqYHhfAoV-PJzxRHysrX47uxCsMlSg7PQWxww1u0,2171
-txt2stix/indicator.py,sha256=EYh3mmgdq-8_5uQrHX5OkQG1sgiO1jQjRCqJaHqyF8k,30770
+txt2stix/indicator.py,sha256=WTj5YIcq37XrjVregfGXvIm2mDuI20gc6IT1-0WcOn8,30629
 txt2stix/lookups.py,sha256=h42YVtYUkWZm6ZPv2h5hHDHDzDs3yBqrT_T7pj2MDZI,2301
-txt2stix/retriever.py,sha256=sMNhnEYk3l5W44qZsWaDQtJYoHXA1oYIPM6wDqiUHSg,6642
+txt2stix/retriever.py,sha256=CwcCVER1sAPHeMojcIgdWMEJ5596tyYDf5HAJXiBdOM,7021
 txt2stix/stix.py,sha256=9nXD9a2dCY4uaatl-mlIA1k3srwQBhGW-tUSho3iYe0,30
 txt2stix/txt2stix.py,sha256=eUL0pynQXruJRDvqs-LQ-dspDITx5tFDnTPEgCRQApk,23348
 txt2stix/utils.py,sha256=Le0VYx8n8UNpcjqwpx7Avb06qIS9_hId8yP8_PquBUs,3333
@@ -74,8 +74,8 @@ txt2stix/pattern/extractors/url/url_extractor.py,sha256=-SH1WvxbViaRZ1on8lRlzNAc
 txt2stix/pattern/extractors/url/url_file_extractor.py,sha256=_VDu_BX3Ys9SKhZlscZPp9xSOKCxNKKvJ2gbe7Nvuv0,881
 txt2stix/pattern/extractors/url/url_path_extractor.py,sha256=FNKcMZRnJpcZZF44T8DHsDWzhBqPq5a23h7T7l2osac,2459
 txt2stix/includes/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-txt2stix/includes/extractions/ai/config.yaml,sha256=wvuezRfzG7tVfEIPgU1mxm4d_a4D7FW5E6ldn0Ci4G8,43734
-txt2stix/includes/extractions/lookup/config.yaml,sha256=m97Rzst-Fq3sMI7KV0mEuOqlbI1-0fU6UoicqDY1vng,12494
+txt2stix/includes/extractions/ai/config.yaml,sha256=G2tYApzY8sXNazXEQ5Iz4-ttlLuZpq2Cogh_M6JMGC4,44598
+txt2stix/includes/extractions/lookup/config.yaml,sha256=STMOoFhaBFq5Od6SwM8w1MTbJTGv57A2ola6IrFVlEk,13160
 txt2stix/includes/extractions/pattern/config.yaml,sha256=92buge3fYegXIN1TSjLKq4PdIbKAGvDAc4CoQpR38sA,20196
 txt2stix/includes/helpers/mimetype_filename_extension_list.csv,sha256=kgozjMyp7y87CqRcoedfDwNXSLKrDgC9r9YKDYK0EbY,27593
 txt2stix/includes/helpers/stix_relationship_types.txt,sha256=PQytANVSrWepdK_SLEZtfiTe1eoxj6YMGUZslO_C1oc,505
@@ -114,8 +114,8 @@ txt2stix/includes/lookups/threat_actor.txt,sha256=QfDO9maQuqKBgW_Sdd7VGv1SHZ9Ra-
 txt2stix/includes/lookups/tld.txt,sha256=-MEgJea2NMG_KDsnc4BVvI8eRk5Dm93L-t8SGYx5wMo,8598
 txt2stix/includes/lookups/tool.txt,sha256=HGKG6JpUE26w6ezzSxOjBkp15UpSaB7N-mZ_NU_3G7A,6
 txt2stix/includes/tests/test_cases.yaml,sha256=vErA3c5fySeWvJ5yJ8dCTEo3ufRATASAjaF4gj4Az1M,22424
-txt2stix-1.1.15.dist-info/METADATA,sha256=T0fs62OPjEKhNiV4qpfZMArmA66PlYQHQh21t0QeW78,15032
-txt2stix-1.1.15.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-txt2stix-1.1.15.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
-txt2stix-1.1.15.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
-txt2stix-1.1.15.dist-info/RECORD,,
+txt2stix-1.2.1.dist-info/METADATA,sha256=VVAo2wu_82WMorGzQ9GunxNn1jksDMyL3zarumW8L_M,15031
+txt2stix-1.2.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+txt2stix-1.2.1.dist-info/entry_points.txt,sha256=x6QPtt65hWeomw4IpJ_wQUesBl1M4WOLODbhOKyWMFg,55
+txt2stix-1.2.1.dist-info/licenses/LICENSE,sha256=BK8Ppqlc4pdgnNzIxnxde0taoQ1BgicdyqmBvMiNYgY,11364
+txt2stix-1.2.1.dist-info/RECORD,,