txt2stix 1.1.8__tar.gz → 1.1.10__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {txt2stix-1.1.8 → txt2stix-1.1.10}/PKG-INFO +2 -10
- {txt2stix-1.1.8 → txt2stix-1.1.10}/README.md +1 -9
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/extractions/ai/config.yaml +20 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/extractions/lookup/config.yaml +33 -15
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/_generate_lookups.py +39 -30
- txt2stix-1.1.8/includes/lookups/disarm_id_v1_5.txt → txt2stix-1.1.10/includes/lookups/disarm_id_v1_6.txt +95 -32
- txt2stix-1.1.8/includes/lookups/disarm_name_v1_5.txt → txt2stix-1.1.10/includes/lookups/disarm_name_v1_6.txt +380 -317
- txt2stix-1.1.8/includes/lookups/mitre_atlas_id_v4_5_2.txt → txt2stix-1.1.10/includes/lookups/mitre_atlas_id_v4_9_0.txt +41 -1
- txt2stix-1.1.10/includes/lookups/mitre_atlas_name_v4_9_0.txt +157 -0
- txt2stix-1.1.8/includes/lookups/mitre_attack_enterprise_aliases_v16_0.txt → txt2stix-1.1.10/includes/lookups/mitre_attack_enterprise_aliases_v18_0.txt +679 -531
- txt2stix-1.1.10/includes/lookups/mitre_attack_enterprise_id_v18_0.txt +4293 -0
- txt2stix-1.1.10/includes/lookups/mitre_attack_enterprise_name_v18_0.txt +4295 -0
- txt2stix-1.1.8/includes/lookups/mitre_attack_ics_aliases_v16_0.txt → txt2stix-1.1.10/includes/lookups/mitre_attack_ics_aliases_v18_0.txt +7 -3
- txt2stix-1.1.10/includes/lookups/mitre_attack_ics_id_v18_0.txt +410 -0
- txt2stix-1.1.8/includes/lookups/mitre_attack_ics_name_v16_0.txt → txt2stix-1.1.10/includes/lookups/mitre_attack_ics_name_v18_0.txt +172 -53
- txt2stix-1.1.8/includes/lookups/mitre_attack_mobile_aliases_v16_0.txt → txt2stix-1.1.10/includes/lookups/mitre_attack_mobile_aliases_v18_0.txt +33 -0
- txt2stix-1.1.10/includes/lookups/mitre_attack_mobile_id_v18_0.txt +643 -0
- txt2stix-1.1.10/includes/lookups/mitre_attack_mobile_name_v18_0.txt +645 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/mitre_capec_name_v3_9.txt +522 -522
- txt2stix-1.1.8/includes/lookups/mitre_cwe_id_v4_15.txt → txt2stix-1.1.10/includes/lookups/mitre_cwe_id_v4_18.txt +5 -0
- txt2stix-1.1.8/includes/lookups/mitre_cwe_name_v4_15.txt → txt2stix-1.1.10/includes/lookups/mitre_cwe_name_v4_18.txt +889 -884
- txt2stix-1.1.10/includes/lookups/sector_aliases_v1_0.txt +751 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/tests/test_cases.yaml +8 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/pyproject.toml +1 -1
- {txt2stix-1.1.8 → txt2stix-1.1.10}/requirements.txt +1 -1
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/all_cases.txt +2 -8
- txt2stix-1.1.10/tests/data/extraction_types/generic_sector_aliases.txt +8 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/manual-tests/cases-extraction-type-ai.md +73 -60
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/manual-tests/cases-extraction-type-lookup.md +13 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_retriever.py +10 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/retriever.py +6 -0
- txt2stix-1.1.8/includes/lookups/mitre_atlas_name_v4_5_2.txt +0 -117
- txt2stix-1.1.8/includes/lookups/mitre_attack_enterprise_id_v16_0.txt +0 -1656
- txt2stix-1.1.8/includes/lookups/mitre_attack_enterprise_name_v16_0.txt +0 -1765
- txt2stix-1.1.8/includes/lookups/mitre_attack_ics_id_v16_0.txt +0 -254
- txt2stix-1.1.8/includes/lookups/mitre_attack_mobile_id_v16_0.txt +0 -277
- txt2stix-1.1.8/includes/lookups/mitre_attack_mobile_name_v16_0.txt +0 -296
- {txt2stix-1.1.8 → txt2stix-1.1.10}/.env.example +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/.env.markdown +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/.github/workflows/create-release.yml +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/.github/workflows/run-tests.yml +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/.gitignore +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/LICENSE +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/docs/README.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/docs/stix-mapping.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/docs/txt2stix.png +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/extractions/pattern/config.yaml +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/helpers/mimetype_filename_extension_list.csv +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/helpers/stix_relationship_types.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/helpers/tlds.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/helpers/windows_registry_key_prefix.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/_README.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/attack_pattern.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/campaign.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/country_iso3166_alpha2.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/course_of_action.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/extensions.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/identity.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/infrastructure.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/intrusion_set.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/malware.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/mitre_capec_id_v3_9.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/threat_actor.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/tld.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/includes/lookups/tool.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/README.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_country.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_mitre_attack_enterprise.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_mitre_attack_ics.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_mitre_attack_mobile.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_mitre_capec.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/ai_mitre_cwe.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_autonomous_system_number.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_all.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_amex.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_diners.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_discover.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_jcb.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_mastercard.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_union_pay.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_bank_card_visa.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_country_alpha2.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cpe_uri.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_btc_transaction.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_btc_wallet.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_eth_transaction.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_eth_wallet.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_xmr_transaction.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cryptocurrency_xmr_wallet.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_cve_id.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_directory_unix.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_directory_unix_file.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_directory_windows.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_directory_windows_with_file.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_disarm.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_disarm_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_domain_name_only.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_domain_name_subdomain.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_email_address.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_md5.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_sha_1.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_sha_224.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_sha_256.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_sha_384.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_hash_sha_512.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_file_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_host_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_host_name_file.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_host_name_path.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_host_name_subdomain.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_host_name_url.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_iban_number.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv4_address_cidr.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv4_address_only.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv4_address_port.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv6_address_cidr.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv6_address_only.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_ipv6_address_port.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mac_address.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_atlas.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_atlas_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_enterprise.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_enterprise_aliases.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_enterprise_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_ics.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_ics_aliases.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_ics_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_mobile.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_mobile_aliases.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_attack_mobile_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_capec.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_capec_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_cwe.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_mitre_cwe_name.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_phone_number.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_url.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_url_file.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_url_path.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_user_agent.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/generic_windows_registry_key.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_attack_pattern.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_campaign.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_course_of_action.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_identity.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_infrastructure.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_intrusion_set.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_malware.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_threat_actor.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/extraction_types/lookup_tool.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/ai_index_position.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/attack_flow_demo.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/attack_navigator_demo.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/bad_vulmatch_lookups.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/basic_relationship.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/char_length_too_long.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/descriptive_for_ai_relationships_1.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/disarm_demo.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/embedded_img_ignore.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/embedded_link_ignore.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/ip1.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/ip2.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/known_whitelist_match.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/mitre_attack_enterprise_ai_demo.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/mitre_attack_enterprise_lookup_demo.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/mixed_extractions.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/not_security_content.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/test_ai_hash_error_with_stix2_lib.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/test_aliases.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/test_extraction_boundary.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/manually_generated_reports/test_extraction_escapes.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/APT28-Center-of-Storm-2017.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/Bitdefender-Labs-Report-X-creat6958-en-EN.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/FireEyeAPT39.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/France_CERT_APT31_Pakdoor_TLPWHITE.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/Group-IB_Ransomware_Uncovered_whitepaper_eng.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/TA22-0126-QAKBOT-analysis-TLP-GREEN.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/dinners_card.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/mandiant-apt1.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/data/real_intel_reports/mykings_report_final.txt +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/manual-tests/cases-ai-relationships.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/manual-tests/cases-extraction-type-pattern.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/manual-tests/cases-standard-tests.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/scripts/generate_simple_extraction_test_cases_txt_files.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_attack_flow.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_bundler.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_extractors.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_indicator.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_lookups.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_main.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_run_txt2stix.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/test_utils.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/tests/src/utils.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/anthropic.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/base.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/deepseek.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/gemini.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/openai.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/openrouter.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/prompts.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/ai_extractor/utils.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/attack_flow.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/bundler.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/common.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/credential_checker.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/extractions.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/indicator.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/lookups.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/base_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/README.md +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/amex_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/diners_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/discover_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/jcb_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/master_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/union_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/card/visa_card_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/crypto/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/crypto/btc_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/directory/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/directory/unix_directory_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/directory/unix_file_path_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/directory/windows_directory_path_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/directory/windows_file_path_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/domain/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/domain/domain_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/domain/hostname_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/domain/sub_domain_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/md5_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha1_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha224_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha2_256_exactor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha2_512_exactor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha3_256_exactor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/hashes/sha3_512_exactor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/helper.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv4_cidr_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv4_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv4_port_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv6_cidr_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv6_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/ip/ipv6_port_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/asn_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/cpe_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/cve_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/email_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/filename_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/iban_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/mac_address_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/phonenumber_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/user_agent_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/others/windows_registry_key_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/url/__init__.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/url/url_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/url/url_file_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/pattern/extractors/url/url_path_extractor.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/stix.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/txt2stix.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix/utils.py +0 -0
- {txt2stix-1.1.8 → txt2stix-1.1.10}/txt2stix.py +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: txt2stix
|
|
3
|
-
Version: 1.1.
|
|
3
|
+
Version: 1.1.10
|
|
4
4
|
Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
|
|
5
5
|
Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
|
|
6
6
|
Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues
|
|
@@ -211,17 +211,9 @@ If you would like to understand how txt2stix works in more detail, please refer
|
|
|
211
211
|
|
|
212
212
|
This documentation is paticularly helpful to read for those of you wanting to add your own custom extractions.
|
|
213
213
|
|
|
214
|
-
## Useful supporting tools
|
|
215
|
-
|
|
216
|
-
* [A Quick Start Guide to txt2stix](https://www.dogesec.com/blog/txt2stix_quickstart_guide/)
|
|
217
|
-
* [An example of how to use txt2stix with Attack Flows](https://www.dogesec.com/blog/understading_structure_attack_flows/)
|
|
218
|
-
* [STIX2 Python Library](https://pypi.org/project/stix2/): APIs for serializing and de-serializing STIX2 JSON content
|
|
219
|
-
* [STIX 2 Pattern Validator](https://pypi.org/project/stix2-patterns/): a tool for checking the syntax of the Cyber Threat Intelligence (CTI) STIX Pattern expressions
|
|
220
|
-
* [STIX Viewer](https://github.com/traut/stixview): Quickly load bundles produced from your report
|
|
221
|
-
|
|
222
214
|
## Support
|
|
223
215
|
|
|
224
|
-
[Minimal support provided via the
|
|
216
|
+
[Minimal support provided via the dogesec community](https://community.dogesec.com/).
|
|
225
217
|
|
|
226
218
|
## License
|
|
227
219
|
|
|
@@ -165,17 +165,9 @@ If you would like to understand how txt2stix works in more detail, please refer
|
|
|
165
165
|
|
|
166
166
|
This documentation is paticularly helpful to read for those of you wanting to add your own custom extractions.
|
|
167
167
|
|
|
168
|
-
## Useful supporting tools
|
|
169
|
-
|
|
170
|
-
* [A Quick Start Guide to txt2stix](https://www.dogesec.com/blog/txt2stix_quickstart_guide/)
|
|
171
|
-
* [An example of how to use txt2stix with Attack Flows](https://www.dogesec.com/blog/understading_structure_attack_flows/)
|
|
172
|
-
* [STIX2 Python Library](https://pypi.org/project/stix2/): APIs for serializing and de-serializing STIX2 JSON content
|
|
173
|
-
* [STIX 2 Pattern Validator](https://pypi.org/project/stix2-patterns/): a tool for checking the syntax of the Cyber Threat Intelligence (CTI) STIX Pattern expressions
|
|
174
|
-
* [STIX Viewer](https://github.com/traut/stixview): Quickly load bundles produced from your report
|
|
175
|
-
|
|
176
168
|
## Support
|
|
177
169
|
|
|
178
|
-
[Minimal support provided via the
|
|
170
|
+
[Minimal support provided via the dogesec community](https://community.dogesec.com/).
|
|
179
171
|
|
|
180
172
|
## License
|
|
181
173
|
|
|
@@ -876,6 +876,26 @@ ai_mitre_cwe:
|
|
|
876
876
|
test_cases: ai_mitre_cwe
|
|
877
877
|
stix_mapping: ctibutler-mitre-cwe-id
|
|
878
878
|
|
|
879
|
+
####### Sector #######
|
|
880
|
+
|
|
881
|
+
ai_sector:
|
|
882
|
+
type: ai
|
|
883
|
+
dogesec_web: true
|
|
884
|
+
name: 'Sectors'
|
|
885
|
+
description: 'Detect which sectors from a fixed sector list are referenced anywhere in the input text.'
|
|
886
|
+
notes: 'lookup_sector_aliases legacy extraction also exists if you cannot use AI'
|
|
887
|
+
created: 2020-01-01
|
|
888
|
+
modified: 2020-01-01
|
|
889
|
+
created_by: dogesec
|
|
890
|
+
version: 1.0.0
|
|
891
|
+
prompt_base: |
|
|
892
|
+
You will be given a list of possible sectors. Check whatever sector best matches what is being referenced in the text
|
|
893
|
+
(either directly or via obvious common synonyms).
|
|
894
|
+
prompt_helper: ''
|
|
895
|
+
prompt_conversion: 'Should respond with one of ["Road transport","Hospitality","Finance","Lodging industry","Hosting service providers","Technologies","Information Technologies Consulting","Travel and tourism industry","Food and drinks businesses","Banking institutions","Education","Defense industry","Diplomacy","Schools","Non-Governmental Organizations (NGOs)","Healthcare research","Defense ministries (including the military)","Oil","Research","Think tanks","Political parties","Legislative branch (parliamentary chambers)","Mining","Defense research and development","Gambling","Air transport","Nuclear power (civilian use)","Energy","Consulting","Maritime transport","Insurance services","Government and administrations","Market infrastructures","Transport","Gas","Citizens","Digital infrastructures","Heavy industries","Engineering consulting","Construction","Local administrations","Ministries of foreign affairs","Telecommunications","Sports","Agriculture and agribusiness","Entertainment industry","Logistics","Central administration and government","Retail (distribution)","Internet Service providers","Pharmacy and drugs manufacturing","Financial organizations","Manufacturing","Universities","Defense","International organizations","Legal consulting","Renewable energies","Health","Rail transport","Culture","Civil society","Culture and entertainment","Medias and audiovisual","Unknown","Healthcare services","Dissidents","Water distribution and supply","Electricity","Judicial power (justice)","High-tech"]'
|
|
896
|
+
test_cases: ai_sector_names
|
|
897
|
+
stix_mapping: ctibutler-sector-name
|
|
898
|
+
|
|
879
899
|
####### Generic Extractions #######
|
|
880
900
|
|
|
881
901
|
ai_attack_pattern:
|
|
@@ -24,7 +24,7 @@ lookup_mitre_attack_enterprise_id:
|
|
|
24
24
|
name: 'MITRE ATT&CK Enterprise IDs'
|
|
25
25
|
description: 'Extracts MITRE ATT&CK Enterprise IDs from text. See lookup name for version used.'
|
|
26
26
|
notes: 'ai_mitre_attack_enterprise also exists but beware of hallucinations'
|
|
27
|
-
file: 'lookups/
|
|
27
|
+
file: 'lookups/mitre_attack_enterprise_id_v18_0.txt'
|
|
28
28
|
created: 2020-01-01
|
|
29
29
|
modified: 2020-01-01
|
|
30
30
|
created_by: dogesec
|
|
@@ -38,7 +38,7 @@ lookup_mitre_attack_enterprise_name:
|
|
|
38
38
|
name: 'MITRE ATT&CK Enterprise names'
|
|
39
39
|
description: 'Extracts MITRE ATT&CK Enterprise names from text. See lookup name for version used.'
|
|
40
40
|
notes: 'ai_mitre_attack_enterprise also exists but beware of hallucinations'
|
|
41
|
-
file: 'lookups/
|
|
41
|
+
file: 'lookups/mitre_attack_enterprise_name_v18_0.txt'
|
|
42
42
|
created: 2020-01-01
|
|
43
43
|
modified: 2020-01-01
|
|
44
44
|
created_by: dogesec
|
|
@@ -52,7 +52,7 @@ lookup_mitre_attack_enterprise_alias:
|
|
|
52
52
|
name: 'MITRE ATT&CK Enterprise alias'
|
|
53
53
|
description: 'Extracts MITRE ATT&CK Enterprise aliases from text. See lookup name for version used.'
|
|
54
54
|
notes: 'ai_mitre_attack_enterprise also exists but beware of hallucinations'
|
|
55
|
-
file: 'lookups/
|
|
55
|
+
file: 'lookups/mitre_attack_enterprise_aliases_v18_0.txt'
|
|
56
56
|
created: 2020-01-01
|
|
57
57
|
modified: 2020-01-01
|
|
58
58
|
created_by: dogesec
|
|
@@ -66,7 +66,7 @@ lookup_mitre_attack_mobile_id:
|
|
|
66
66
|
name: 'MITRE ATT&CK Mobile IDs'
|
|
67
67
|
description: 'Extracts MITRE ATT&CK Mobile IDs from text. See lookup name for version used.'
|
|
68
68
|
notes: 'ai_mitre_attack_mobile also exists but beware of hallucinations'
|
|
69
|
-
file: 'lookups/
|
|
69
|
+
file: 'lookups/mitre_attack_mobile_id_v18_0.txt'
|
|
70
70
|
created: 2020-01-01
|
|
71
71
|
modified: 2020-01-01
|
|
72
72
|
created_by: dogesec
|
|
@@ -80,7 +80,7 @@ lookup_mitre_attack_mobile_name:
|
|
|
80
80
|
name: 'MITRE ATT&CK Mobile names'
|
|
81
81
|
description: 'Extracts MITRE ATT&CK Mobile names from text. See lookup name for version used.'
|
|
82
82
|
notes: 'ai_mitre_attack_mobile also exists but beware of hallucinations'
|
|
83
|
-
file: 'lookups/
|
|
83
|
+
file: 'lookups/mitre_attack_mobile_name_v18_0.txt'
|
|
84
84
|
created: 2020-01-01
|
|
85
85
|
modified: 2020-01-01
|
|
86
86
|
created_by: dogesec
|
|
@@ -94,7 +94,7 @@ lookup_mitre_attack_mobile_alias:
|
|
|
94
94
|
name: 'MITRE ATT&CK Mobile alias'
|
|
95
95
|
description: 'Extracts MITRE ATT&CK Mobile aliases from text. See lookup name for version used.'
|
|
96
96
|
notes: 'ai_mitre_attack_mobile also exists but beware of hallucinations'
|
|
97
|
-
file: 'lookups/
|
|
97
|
+
file: 'lookups/mitre_attack_mobile_aliases_v18_0.txt'
|
|
98
98
|
created: 2020-01-01
|
|
99
99
|
modified: 2020-01-01
|
|
100
100
|
created_by: dogesec
|
|
@@ -108,7 +108,7 @@ lookup_mitre_attack_ics_id:
|
|
|
108
108
|
name: 'MITRE ATT&CK ICS IDs'
|
|
109
109
|
description: 'Extracts MITRE ATT&CK ICS names from text. See lookup name for version used.'
|
|
110
110
|
notes: 'ai_mitre_attack_ics also exists but beware of hallucinations'
|
|
111
|
-
file: 'lookups/
|
|
111
|
+
file: 'lookups/mitre_attack_ics_id_v18_0.txt'
|
|
112
112
|
created: 2020-01-01
|
|
113
113
|
modified: 2020-01-01
|
|
114
114
|
created_by: dogesec
|
|
@@ -122,7 +122,7 @@ lookup_mitre_attack_ics_name:
|
|
|
122
122
|
name: 'MITRE ATT&CK ICS names'
|
|
123
123
|
description: 'Extracts MITRE ATT&CK ICS names from text. See lookup name for version used.'
|
|
124
124
|
notes: 'ai_mitre_attack_ics also exists but beware of hallucinations'
|
|
125
|
-
file: 'lookups/
|
|
125
|
+
file: 'lookups/mitre_attack_ics_name_v18_0.txt'
|
|
126
126
|
created: 2020-01-01
|
|
127
127
|
modified: 2020-01-01
|
|
128
128
|
created_by: dogesec
|
|
@@ -136,7 +136,7 @@ lookup_mitre_attack_ics_alias:
|
|
|
136
136
|
name: 'MITRE ATT&CK ICS alias'
|
|
137
137
|
description: 'Extracts MITRE ATT&CK ICS aliases from text. See lookup name for version used.'
|
|
138
138
|
notes: 'ai_mitre_attack_ics also exists but beware of hallucinations'
|
|
139
|
-
file: 'lookups/
|
|
139
|
+
file: 'lookups/mitre_attack_ics_aliases_v18_0.txt'
|
|
140
140
|
created: 2020-01-01
|
|
141
141
|
modified: 2020-01-01
|
|
142
142
|
created_by: dogesec
|
|
@@ -182,7 +182,7 @@ lookup_mitre_cwe_id:
|
|
|
182
182
|
name: MITRE CWE IDs
|
|
183
183
|
description: 'Extracts MITRE CWE IDs from text. See lookup name for version used.'
|
|
184
184
|
notes: 'ai_mitre_cwe also exists but beware of hallucinations'
|
|
185
|
-
file: 'lookups/
|
|
185
|
+
file: 'lookups/mitre_cwe_id_v4_18.txt'
|
|
186
186
|
created: 2020-01-01
|
|
187
187
|
modified: 2020-01-01
|
|
188
188
|
created_by: dogesec
|
|
@@ -196,7 +196,7 @@ lookup_mitre_cwe_name:
|
|
|
196
196
|
name: MITRE CWE names
|
|
197
197
|
description: 'Extracts MITRE CWE names from text. See lookup name for version used.'
|
|
198
198
|
notes: 'ai_mitre_cwe also exists but beware of hallucinations'
|
|
199
|
-
file: 'lookups/
|
|
199
|
+
file: 'lookups/mitre_cwe_name_v4_18.txt'
|
|
200
200
|
created: 2020-01-01
|
|
201
201
|
modified: 2020-01-01
|
|
202
202
|
created_by: dogesec
|
|
@@ -212,7 +212,7 @@ lookup_mitre_atlas_id:
|
|
|
212
212
|
name: MITRE ATLAS IDs
|
|
213
213
|
description: 'Extracts MITRE ATLAS IDs from text. See lookup name for version used.'
|
|
214
214
|
notes: 'No corresponding AI version yet due to poor AI performance'
|
|
215
|
-
file: 'lookups/
|
|
215
|
+
file: 'lookups/mitre_atlas_id_v4_9_0.txt'
|
|
216
216
|
created: 2020-01-01
|
|
217
217
|
modified: 2020-01-01
|
|
218
218
|
created_by: dogesec
|
|
@@ -226,7 +226,7 @@ lookup_mitre_atlas_name:
|
|
|
226
226
|
name: MITRE ATLAS names
|
|
227
227
|
description: 'Extracts MITRE ATLAS names from text. See lookup name for version used.'
|
|
228
228
|
notes: 'No corresponding AI version yet due to poor AI performance'
|
|
229
|
-
file: 'lookups/
|
|
229
|
+
file: 'lookups/mitre_atlas_name_v4_9_0.txt'
|
|
230
230
|
created: 2020-01-01
|
|
231
231
|
modified: 2020-01-01
|
|
232
232
|
created_by: dogesec
|
|
@@ -242,7 +242,7 @@ lookup_disarm_id:
|
|
|
242
242
|
name: DISARM names
|
|
243
243
|
description: 'Extracts DISARM IDs from text. See lookup name for version used.'
|
|
244
244
|
notes: 'No corresponding AI version yet due to poor AI performance'
|
|
245
|
-
file: 'lookups/
|
|
245
|
+
file: 'lookups/disarm_id_v1_6.txt'
|
|
246
246
|
created: 2020-01-01
|
|
247
247
|
modified: 2020-01-01
|
|
248
248
|
created_by: dogesec
|
|
@@ -256,7 +256,7 @@ lookup_disarm_name:
|
|
|
256
256
|
name: DISARM IDs
|
|
257
257
|
description: 'Extracts DISARM names from text. See lookup name for version used.'
|
|
258
258
|
notes: 'No corresponding AI version yet due to poor AI performance'
|
|
259
|
-
file: 'lookups/
|
|
259
|
+
file: 'lookups/disarm_name_v1_6.txt'
|
|
260
260
|
created: 2020-01-01
|
|
261
261
|
modified: 2020-01-01
|
|
262
262
|
created_by: dogesec
|
|
@@ -264,6 +264,22 @@ lookup_disarm_name:
|
|
|
264
264
|
test_cases: generic_disarm_name
|
|
265
265
|
stix_mapping: ctibutler-disarm-name
|
|
266
266
|
|
|
267
|
+
####### Sector #######
|
|
268
|
+
|
|
269
|
+
lookup_sector_alias:
|
|
270
|
+
type: lookup
|
|
271
|
+
dogesec_web: false
|
|
272
|
+
name: 'Sector names'
|
|
273
|
+
description: 'Extracts Sector alias from text.'
|
|
274
|
+
notes: 'ai_mitre_attack_ics also exists but beware of hallucinations'
|
|
275
|
+
file: 'lookups/sector_aliases_v1_0.txt'
|
|
276
|
+
created: 2020-01-01
|
|
277
|
+
modified: 2020-01-01
|
|
278
|
+
created_by: dogesec
|
|
279
|
+
version: 1.0.0
|
|
280
|
+
test_cases: generic_sector_aliases
|
|
281
|
+
stix_mapping: ctibutler-sector-alias
|
|
282
|
+
|
|
267
283
|
####### Generic Extractions #######
|
|
268
284
|
|
|
269
285
|
lookup_attack_pattern:
|
|
@@ -391,3 +407,5 @@ lookup_tool:
|
|
|
391
407
|
version: 1.0.0
|
|
392
408
|
test_cases: lookup_tool
|
|
393
409
|
stix_mapping: tool
|
|
410
|
+
|
|
411
|
+
|
|
@@ -12,10 +12,10 @@ script_dir = os.path.dirname(os.path.abspath(__file__))
|
|
|
12
12
|
|
|
13
13
|
# Define queries and output files
|
|
14
14
|
queries = {
|
|
15
|
-
"
|
|
15
|
+
"mitre_cwe_id_v4_18.txt":
|
|
16
16
|
"""
|
|
17
17
|
FOR doc IN mitre_cwe_vertex_collection
|
|
18
|
-
FILTER doc._stix2arango_note == "version=
|
|
18
|
+
FILTER doc._stix2arango_note == "version=4_18"
|
|
19
19
|
AND IS_ARRAY(doc.external_references)
|
|
20
20
|
AND doc.x_mitre_deprecated != true
|
|
21
21
|
AND doc.revoked != true
|
|
@@ -27,10 +27,10 @@ queries = {
|
|
|
27
27
|
SORT reference.external_id ASC
|
|
28
28
|
RETURN reference.external_id
|
|
29
29
|
""",
|
|
30
|
-
"
|
|
30
|
+
"mitre_cwe_name_v4_18.txt":
|
|
31
31
|
"""
|
|
32
32
|
FOR doc IN mitre_cwe_vertex_collection
|
|
33
|
-
FILTER doc._stix2arango_note == "version=
|
|
33
|
+
FILTER doc._stix2arango_note == "version=4_18"
|
|
34
34
|
AND IS_ARRAY(doc.external_references)
|
|
35
35
|
AND doc.x_mitre_deprecated != true
|
|
36
36
|
AND doc.revoked != true
|
|
@@ -65,10 +65,10 @@ queries = {
|
|
|
65
65
|
AND !CONTAINS(doc.name, "DEPRECATED:")
|
|
66
66
|
RETURN doc.name
|
|
67
67
|
""",
|
|
68
|
-
"
|
|
68
|
+
"mitre_attack_enterprise_id_v18_0.txt":
|
|
69
69
|
"""
|
|
70
70
|
FOR doc IN mitre_attack_enterprise_vertex_collection
|
|
71
|
-
FILTER doc._stix2arango_note == "version=
|
|
71
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
72
72
|
AND doc.type != "x-mitre-matrix"
|
|
73
73
|
AND doc.x_mitre_deprecated != true
|
|
74
74
|
AND doc.revoked != true
|
|
@@ -78,21 +78,21 @@ queries = {
|
|
|
78
78
|
SORT reference.external_id ASC
|
|
79
79
|
RETURN reference.external_id
|
|
80
80
|
""",
|
|
81
|
-
"
|
|
81
|
+
"mitre_attack_enterprise_name_v18_0.txt":
|
|
82
82
|
"""
|
|
83
83
|
FOR doc IN mitre_attack_enterprise_vertex_collection
|
|
84
|
-
FILTER doc._stix2arango_note == "version=
|
|
84
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
85
85
|
AND doc.type != "x-mitre-matrix"
|
|
86
86
|
AND doc.x_mitre_deprecated != true
|
|
87
87
|
AND doc.revoked != true
|
|
88
88
|
RETURN doc.name
|
|
89
89
|
""",
|
|
90
|
-
"
|
|
90
|
+
"mitre_attack_enterprise_aliases_v18_0.txt":
|
|
91
91
|
"""
|
|
92
92
|
FOR alias IN UNIQUE(
|
|
93
93
|
FLATTEN(
|
|
94
94
|
FOR doc IN mitre_attack_enterprise_vertex_collection
|
|
95
|
-
FILTER doc._stix2arango_note == "version=
|
|
95
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
96
96
|
AND doc.type != "x-mitre-matrix"
|
|
97
97
|
AND doc.x_mitre_deprecated != true
|
|
98
98
|
AND doc.revoked != true
|
|
@@ -106,10 +106,10 @@ queries = {
|
|
|
106
106
|
)
|
|
107
107
|
RETURN alias
|
|
108
108
|
""",
|
|
109
|
-
"
|
|
109
|
+
"mitre_attack_ics_id_v18_0.txt":
|
|
110
110
|
"""
|
|
111
111
|
FOR doc IN mitre_attack_ics_vertex_collection
|
|
112
|
-
FILTER doc._stix2arango_note == "version=
|
|
112
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
113
113
|
AND doc.type != "x-mitre-matrix"
|
|
114
114
|
AND doc.x_mitre_deprecated != true
|
|
115
115
|
AND doc.revoked != true
|
|
@@ -119,21 +119,21 @@ queries = {
|
|
|
119
119
|
SORT reference.external_id ASC
|
|
120
120
|
RETURN reference.external_id
|
|
121
121
|
""",
|
|
122
|
-
"
|
|
122
|
+
"mitre_attack_ics_name_v18_0.txt":
|
|
123
123
|
"""
|
|
124
124
|
FOR doc IN mitre_attack_ics_vertex_collection
|
|
125
|
-
FILTER doc._stix2arango_note == "version=
|
|
125
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
126
126
|
AND doc.type != "x-mitre-matrix"
|
|
127
127
|
AND doc.x_mitre_deprecated != true
|
|
128
128
|
AND doc.revoked != true
|
|
129
129
|
RETURN doc.name
|
|
130
130
|
""",
|
|
131
|
-
"
|
|
131
|
+
"mitre_attack_ics_aliases_v18_0.txt":
|
|
132
132
|
"""
|
|
133
133
|
FOR alias IN UNIQUE(
|
|
134
134
|
FLATTEN(
|
|
135
135
|
FOR doc IN mitre_attack_ics_vertex_collection
|
|
136
|
-
FILTER doc._stix2arango_note == "version=
|
|
136
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
137
137
|
AND doc.type != "x-mitre-matrix"
|
|
138
138
|
AND doc.x_mitre_deprecated != true
|
|
139
139
|
AND doc.revoked != true
|
|
@@ -147,10 +147,10 @@ queries = {
|
|
|
147
147
|
)
|
|
148
148
|
RETURN alias
|
|
149
149
|
""",
|
|
150
|
-
"
|
|
150
|
+
"mitre_attack_mobile_id_v18_0.txt":
|
|
151
151
|
"""
|
|
152
152
|
FOR doc IN mitre_attack_mobile_vertex_collection
|
|
153
|
-
FILTER doc._stix2arango_note == "version=
|
|
153
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
154
154
|
AND doc.type != "x-mitre-matrix"
|
|
155
155
|
AND doc.x_mitre_deprecated != true
|
|
156
156
|
AND doc.revoked != true
|
|
@@ -160,21 +160,21 @@ queries = {
|
|
|
160
160
|
SORT reference.external_id ASC
|
|
161
161
|
RETURN reference.external_id
|
|
162
162
|
""",
|
|
163
|
-
"
|
|
163
|
+
"mitre_attack_mobile_name_v18_0.txt":
|
|
164
164
|
"""
|
|
165
165
|
FOR doc IN mitre_attack_mobile_vertex_collection
|
|
166
|
-
FILTER doc._stix2arango_note == "version=
|
|
166
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
167
167
|
AND doc.type != "x-mitre-matrix"
|
|
168
168
|
AND doc.x_mitre_deprecated != true
|
|
169
169
|
AND doc.revoked != true
|
|
170
170
|
RETURN doc.name
|
|
171
171
|
""",
|
|
172
|
-
"
|
|
172
|
+
"mitre_attack_mobile_aliases_v18_0.txt":
|
|
173
173
|
"""
|
|
174
174
|
FOR alias IN UNIQUE(
|
|
175
175
|
FLATTEN(
|
|
176
176
|
FOR doc IN mitre_attack_mobile_vertex_collection
|
|
177
|
-
FILTER doc._stix2arango_note == "version=
|
|
177
|
+
FILTER doc._stix2arango_note == "version=18_0"
|
|
178
178
|
AND doc.type != "x-mitre-matrix"
|
|
179
179
|
AND doc.x_mitre_deprecated != true
|
|
180
180
|
AND doc.revoked != true
|
|
@@ -188,10 +188,10 @@ queries = {
|
|
|
188
188
|
)
|
|
189
189
|
RETURN alias
|
|
190
190
|
""",
|
|
191
|
-
"
|
|
191
|
+
"mitre_atlas_id_v4_9_0.txt":
|
|
192
192
|
"""
|
|
193
193
|
FOR doc IN mitre_atlas_vertex_collection
|
|
194
|
-
FILTER doc._stix2arango_note == "version=
|
|
194
|
+
FILTER doc._stix2arango_note == "version=4_9_0"
|
|
195
195
|
AND doc.type != "x-mitre-matrix"
|
|
196
196
|
AND doc.x_mitre_deprecated != true
|
|
197
197
|
AND doc.revoked != true
|
|
@@ -201,19 +201,19 @@ queries = {
|
|
|
201
201
|
SORT reference.external_id ASC
|
|
202
202
|
RETURN reference.external_id
|
|
203
203
|
""",
|
|
204
|
-
"
|
|
204
|
+
"mitre_atlas_name_v4_9_0.txt":
|
|
205
205
|
"""
|
|
206
206
|
FOR doc IN mitre_atlas_vertex_collection
|
|
207
|
-
FILTER doc._stix2arango_note == "version=
|
|
207
|
+
FILTER doc._stix2arango_note == "version=4_9_0"
|
|
208
208
|
AND doc.type != "x-mitre-matrix"
|
|
209
209
|
AND doc.x_mitre_deprecated != true
|
|
210
210
|
AND doc.revoked != true
|
|
211
211
|
RETURN doc.name
|
|
212
212
|
""",
|
|
213
|
-
"
|
|
213
|
+
"disarm_id_v1_6.txt":
|
|
214
214
|
"""
|
|
215
215
|
FOR doc IN disarm_vertex_collection
|
|
216
|
-
FILTER doc._stix2arango_note == "version=
|
|
216
|
+
FILTER doc._stix2arango_note == "version=1_6"
|
|
217
217
|
AND doc.type != "x-mitre-matrix"
|
|
218
218
|
AND doc.x_mitre_deprecated != true
|
|
219
219
|
AND doc.revoked != true
|
|
@@ -223,14 +223,23 @@ queries = {
|
|
|
223
223
|
SORT reference.external_id ASC
|
|
224
224
|
RETURN reference.external_id
|
|
225
225
|
""",
|
|
226
|
-
"
|
|
226
|
+
"disarm_name_v1_6.txt":
|
|
227
227
|
"""
|
|
228
228
|
FOR doc IN disarm_vertex_collection
|
|
229
|
-
FILTER doc._stix2arango_note == "version=
|
|
229
|
+
FILTER doc._stix2arango_note == "version=1_6"
|
|
230
230
|
AND doc.type != "x-mitre-matrix"
|
|
231
231
|
AND doc.x_mitre_deprecated != true
|
|
232
232
|
AND doc.revoked != true
|
|
233
233
|
RETURN doc.name
|
|
234
|
+
""",
|
|
235
|
+
"sector_aliases_v1_0.txt":
|
|
236
|
+
"""
|
|
237
|
+
FOR doc IN sector_vertex_collection
|
|
238
|
+
FILTER doc._stix2arango_note == "version=1_0"
|
|
239
|
+
AND doc.revoked != true
|
|
240
|
+
FOR alias IN (doc.x_opencti_aliases ? doc.x_opencti_aliases : [])
|
|
241
|
+
COLLECT alias_dedup = alias
|
|
242
|
+
RETURN alias_dedup
|
|
234
243
|
"""
|
|
235
244
|
}
|
|
236
245
|
|
|
@@ -1,13 +1,14 @@
|
|
|
1
|
+
DISARM
|
|
1
2
|
T0002
|
|
2
3
|
T0003
|
|
3
4
|
T0004
|
|
4
|
-
T0007
|
|
5
5
|
T0010
|
|
6
|
-
T0013
|
|
7
6
|
T0014
|
|
8
7
|
T0014.001
|
|
9
8
|
T0014.002
|
|
10
9
|
T0015
|
|
10
|
+
T0015.001
|
|
11
|
+
T0015.002
|
|
11
12
|
T0016
|
|
12
13
|
T0017
|
|
13
14
|
T0017.001
|
|
@@ -23,9 +24,6 @@ T0029
|
|
|
23
24
|
T0039
|
|
24
25
|
T0040
|
|
25
26
|
T0042
|
|
26
|
-
T0043
|
|
27
|
-
T0043.001
|
|
28
|
-
T0043.002
|
|
29
27
|
T0044
|
|
30
28
|
T0045
|
|
31
29
|
T0046
|
|
@@ -115,11 +113,6 @@ T0088.002
|
|
|
115
113
|
T0089
|
|
116
114
|
T0089.001
|
|
117
115
|
T0089.003
|
|
118
|
-
T0090
|
|
119
|
-
T0090.001
|
|
120
|
-
T0090.002
|
|
121
|
-
T0090.003
|
|
122
|
-
T0090.004
|
|
123
116
|
T0091
|
|
124
117
|
T0091.001
|
|
125
118
|
T0091.002
|
|
@@ -173,31 +166,13 @@ T0102
|
|
|
173
166
|
T0102.001
|
|
174
167
|
T0102.002
|
|
175
168
|
T0102.003
|
|
176
|
-
T0103
|
|
177
|
-
T0103.001
|
|
178
|
-
T0103.002
|
|
179
|
-
T0104
|
|
180
|
-
T0104.001
|
|
181
|
-
T0104.002
|
|
182
|
-
T0104.003
|
|
183
|
-
T0104.004
|
|
184
|
-
T0104.005
|
|
185
|
-
T0104.006
|
|
186
|
-
T0105
|
|
187
|
-
T0105.001
|
|
188
|
-
T0105.002
|
|
189
|
-
T0105.003
|
|
190
|
-
T0106
|
|
191
|
-
T0106.001
|
|
192
169
|
T0107
|
|
193
|
-
T0108
|
|
194
170
|
T0109
|
|
195
171
|
T0110
|
|
196
172
|
T0111
|
|
197
173
|
T0111.001
|
|
198
174
|
T0111.002
|
|
199
175
|
T0111.003
|
|
200
|
-
T0112
|
|
201
176
|
T0113
|
|
202
177
|
T0114
|
|
203
178
|
T0114.001
|
|
@@ -250,7 +225,6 @@ T0129.004
|
|
|
250
225
|
T0129.005
|
|
251
226
|
T0129.006
|
|
252
227
|
T0129.007
|
|
253
|
-
T0129.008
|
|
254
228
|
T0129.009
|
|
255
229
|
T0129.010
|
|
256
230
|
T0130
|
|
@@ -308,9 +282,6 @@ T0140
|
|
|
308
282
|
T0140.001
|
|
309
283
|
T0140.002
|
|
310
284
|
T0140.003
|
|
311
|
-
T0141
|
|
312
|
-
T0141.001
|
|
313
|
-
T0141.002
|
|
314
285
|
T0143
|
|
315
286
|
T0143.001
|
|
316
287
|
T0143.002
|
|
@@ -327,6 +298,98 @@ T0145.004
|
|
|
327
298
|
T0145.005
|
|
328
299
|
T0145.006
|
|
329
300
|
T0145.007
|
|
301
|
+
T0146
|
|
302
|
+
T0146.001
|
|
303
|
+
T0146.002
|
|
304
|
+
T0146.003
|
|
305
|
+
T0146.004
|
|
306
|
+
T0146.005
|
|
307
|
+
T0146.006
|
|
308
|
+
T0146.007
|
|
309
|
+
T0147
|
|
310
|
+
T0147.001
|
|
311
|
+
T0147.002
|
|
312
|
+
T0147.003
|
|
313
|
+
T0147.004
|
|
314
|
+
T0148
|
|
315
|
+
T0148.001
|
|
316
|
+
T0148.002
|
|
317
|
+
T0148.003
|
|
318
|
+
T0148.004
|
|
319
|
+
T0148.005
|
|
320
|
+
T0148.006
|
|
321
|
+
T0148.007
|
|
322
|
+
T0148.008
|
|
323
|
+
T0148.009
|
|
324
|
+
T0149
|
|
325
|
+
T0149.001
|
|
326
|
+
T0149.002
|
|
327
|
+
T0149.003
|
|
328
|
+
T0149.004
|
|
329
|
+
T0149.005
|
|
330
|
+
T0149.006
|
|
331
|
+
T0149.007
|
|
332
|
+
T0149.008
|
|
333
|
+
T0149.009
|
|
334
|
+
T0150
|
|
335
|
+
T0150.001
|
|
336
|
+
T0150.002
|
|
337
|
+
T0150.003
|
|
338
|
+
T0150.004
|
|
339
|
+
T0150.005
|
|
340
|
+
T0150.006
|
|
341
|
+
T0150.007
|
|
342
|
+
T0150.008
|
|
343
|
+
T0151
|
|
344
|
+
T0151.001
|
|
345
|
+
T0151.002
|
|
346
|
+
T0151.003
|
|
347
|
+
T0151.004
|
|
348
|
+
T0151.005
|
|
349
|
+
T0151.006
|
|
350
|
+
T0151.007
|
|
351
|
+
T0151.008
|
|
352
|
+
T0151.009
|
|
353
|
+
T0151.010
|
|
354
|
+
T0151.011
|
|
355
|
+
T0151.012
|
|
356
|
+
T0151.013
|
|
357
|
+
T0151.014
|
|
358
|
+
T0151.015
|
|
359
|
+
T0151.016
|
|
360
|
+
T0151.017
|
|
361
|
+
T0152
|
|
362
|
+
T0152.001
|
|
363
|
+
T0152.002
|
|
364
|
+
T0152.003
|
|
365
|
+
T0152.004
|
|
366
|
+
T0152.005
|
|
367
|
+
T0152.006
|
|
368
|
+
T0152.007
|
|
369
|
+
T0152.008
|
|
370
|
+
T0152.009
|
|
371
|
+
T0152.010
|
|
372
|
+
T0152.011
|
|
373
|
+
T0152.012
|
|
374
|
+
T0153
|
|
375
|
+
T0153.001
|
|
376
|
+
T0153.002
|
|
377
|
+
T0153.003
|
|
378
|
+
T0153.004
|
|
379
|
+
T0153.005
|
|
380
|
+
T0153.006
|
|
381
|
+
T0153.007
|
|
382
|
+
T0154
|
|
383
|
+
T0154.001
|
|
384
|
+
T0154.002
|
|
385
|
+
T0155
|
|
386
|
+
T0155.001
|
|
387
|
+
T0155.002
|
|
388
|
+
T0155.003
|
|
389
|
+
T0155.004
|
|
390
|
+
T0155.005
|
|
391
|
+
T0155.006
|
|
392
|
+
T0155.007
|
|
330
393
|
TA01
|
|
331
394
|
TA02
|
|
332
395
|
TA05
|