txt2stix 1.1.9__tar.gz → 1.1.11__tar.gz

{txt2stix-1.1.9 → txt2stix-1.1.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: txt2stix
-Version: 1.1.9
+Version: 1.1.11
 Summary: txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle.
 Project-URL: Homepage, https://github.com/muchdogesec/txt2stix
 Project-URL: Issues, https://github.com/muchdogesec/txt2stix/issues
@@ -24,7 +24,7 @@ Requires-Dist: python-dotenv>=1.0.1
 Requires-Dist: requests>=2.32.4
 Requires-Dist: schwifty>=2024.6.1
 Requires-Dist: stix2-validator
-Requires-Dist: stix2extensions
+Requires-Dist: stix2extensions>=2.0.1
 Requires-Dist: tld>=0.13
 Requires-Dist: tldextract>=5.1.2
 Requires-Dist: validators>=0.28.3
@@ -211,17 +211,9 @@ If you would like to understand how txt2stix works in more detail, please refer
 
 This documentation is paticularly helpful to read for those of you wanting to add your own custom extractions.
 
-## Useful supporting tools
-
-* [A Quick Start Guide to txt2stix](https://www.dogesec.com/blog/txt2stix_quickstart_guide/)
-* [An example of how to use txt2stix with Attack Flows](https://www.dogesec.com/blog/understading_structure_attack_flows/)
-* [STIX2 Python Library](https://pypi.org/project/stix2/): APIs for serializing and de-serializing STIX2 JSON content
-* [STIX 2 Pattern Validator](https://pypi.org/project/stix2-patterns/): a tool for checking the syntax of the Cyber Threat Intelligence (CTI) STIX Pattern expressions
-* [STIX Viewer](https://github.com/traut/stixview): Quickly load bundles produced from your report
-
 ## Support
 
-[Minimal support provided via the DOGESEC community](https://community.dogesec.com/).
+[Minimal support provided via the dogesec community](https://community.dogesec.com/).
 
 ## License
 

{txt2stix-1.1.9 → txt2stix-1.1.11}/README.md

@@ -165,17 +165,9 @@ If you would like to understand how txt2stix works in more detail, please refer
 
 This documentation is paticularly helpful to read for those of you wanting to add your own custom extractions.
 
-## Useful supporting tools
-
-* [A Quick Start Guide to txt2stix](https://www.dogesec.com/blog/txt2stix_quickstart_guide/)
-* [An example of how to use txt2stix with Attack Flows](https://www.dogesec.com/blog/understading_structure_attack_flows/)
-* [STIX2 Python Library](https://pypi.org/project/stix2/): APIs for serializing and de-serializing STIX2 JSON content
-* [STIX 2 Pattern Validator](https://pypi.org/project/stix2-patterns/): a tool for checking the syntax of the Cyber Threat Intelligence (CTI) STIX Pattern expressions
-* [STIX Viewer](https://github.com/traut/stixview): Quickly load bundles produced from your report
-
 ## Support
 
-[Minimal support provided via the DOGESEC community](https://community.dogesec.com/).
+[Minimal support provided via the dogesec community](https://community.dogesec.com/).
 
 ## License
 

{txt2stix-1.1.9 → txt2stix-1.1.11}/includes/extractions/ai/config.yaml

@@ -881,7 +881,7 @@ ai_mitre_cwe:
 ai_sector:
   type: ai
   dogesec_web: true
-  name: 'Attack Pattern'
+  name: 'Sectors'
   description: 'Detect which sectors from a fixed sector list are referenced anywhere in the input text.'
   notes: 'lookup_sector_aliases legacy extraction also exists if you cannot use AI'
   created: 2020-01-01

{txt2stix-1.1.9 → txt2stix-1.1.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "txt2stix"
-version = "1.1.9"
+version = "1.1.11"
 authors = [{ name = "dogesec" }]
 maintainers = [{ name = "dogesec" }]
 description = "txt2stix is a Python script that is designed to identify and extract IoCs and TTPs from text files, identify the relationships between them, convert them to STIX 2.1 objects, and output as a STIX 2.1 bundle."
@@ -23,7 +23,7 @@ dependencies = [
   "requests>=2.32.4",
   "python-dotenv>=1.0.1",
   "schwifty>=2024.6.1",
-  "stix2extensions",
+  "stix2extensions>=2.0.1",
   "tld>=0.13",
   "tldextract>=5.1.2",
   "validators>=0.28.3",

{txt2stix-1.1.9 → txt2stix-1.1.11}/tests/src/test_indicator.py

@@ -339,13 +339,13 @@ all_extractors = get_all_extractors()
             "DE29100500001061045672",
             "pattern_iban_number",
             {
-                "bank-account--bedcfd65-c65b-5ded-9fa0-c9bfe17d57d0",
+                "relationship--97947636-acc1-5a2f-971f-cfeee373e75e",
+                "bank-account--4e351d05-b4f5-5d7e-b51e-66e92021ba5a",
                 "indicator--816dfb00-4107-5dd0-be00-4607400f4df3",
-                "relationship--78a4214c-9cb2-5efb-b581-30f1f18c0671",
                 "location--8d8abee9-2855-57ea-9df9-5251079802e6",
             },
             {
-                "bank-account--bedcfd65-c65b-5ded-9fa0-c9bfe17d57d0",
+                "bank-account--4e351d05-b4f5-5d7e-b51e-66e92021ba5a",
             },
             id="bank-account",
         ),
@@ -364,36 +364,21 @@ all_extractors = get_all_extractors()
         ],
         ## payment-card, with issuer-name
         pytest.param(
-            "5555555555554444",
+            "4142414241424142",
             "pattern_bank_card_mastercard",
             {
-                "location--24ff45f2-9cd3-554c-a53c-2ed70bb17cb8",
-                "payment-card--45b2fea7-587b-5ccf-a9b2-e0fa748d6423",
-                "relationship--03a31907-32ae-5f83-80a7-37dbe0ed61c2",
-                "indicator--d85b6d0d-116d-5518-8b59-dd018d060bda",
-                "relationship--174da36f-c5d9-5eea-b024-8fcdba87ce56",
-                "identity--7d46a822-1e99-5c73-ac5e-dec6400977ab",
+                "location--e68e76c5-60f1-506e-b495-86adb8ec0a5b",
+                "payment-card--0e1fb108-12c0-5357-9265-d0bcdd90c4bd",
+                "relationship--acd8efa8-3702-5c74-bb9c-ddb9720ca799",
+                "indicator--12f0d365-0b5d-53c4-9b23-2032db90887c",
+                "relationship--f372a1f8-397a-57f1-a14c-fe808dd286cd",
+                "identity--643665ba-f411-5f6f-aa8a-40bb2003529d",
             },
             {
-                "payment-card--45b2fea7-587b-5ccf-a9b2-e0fa748d6423",
+                "payment-card--0e1fb108-12c0-5357-9265-d0bcdd90c4bd",
             },
             id="payment-card, with issuer-name",
         ),
-        ## payment-card, no issuer-name
-        pytest.param(
-            "376654224631002",
-            "pattern_bank_card_amex",
-            {
-                "identity--643246fc-9204-5b4b-976d-2e605b355c24",
-                "payment-card--683af74c-c39f-5ca1-8366-7781f8ac7685",
-                "relationship--57b4a9eb-2e8c-5826-b11f-add6a436d203",
-                "indicator--ce0cb0ba-608e-52fa-9c98-9bff146caef8",
-            },
-            {
-                "payment-card--683af74c-c39f-5ca1-8366-7781f8ac7685",
-            },
-            id="payment-card, no issuer-name",
-        ),
     ],
 )
 def test_build_observables(value, extractor_name, expected_objects, expected_rels):
@@ -402,7 +387,6 @@ def test_build_observables(value, extractor_name, expected_objects, expected_rel
     objects, relationships = build_observables(
         mock_bundler, extractor.stix_mapping, indicator, value, extractor
     )
-    print({obj["id"] for obj in objects})
     assert {obj["id"] for obj in objects} == set(expected_objects)
     assert {id for id in relationships} == set(expected_rels)
 

{txt2stix-1.1.9 → txt2stix-1.1.11}/txt2stix/attack_flow.py

@@ -7,7 +7,7 @@ from txt2stix import txt2stixBundler
 from txt2stix.ai_extractor.base import BaseAIExtractor
 from txt2stix.common import UUID_NAMESPACE
 from txt2stix.retriever import STIXObjectRetriever
-from stix2extensions.attack_action import AttackAction, AttackFlow
+from stix2extensions import AttackAction, AttackFlow
 from .utils import AttackFlowList
 
 def parse_flow(report, flow: AttackFlowList, techniques, tactics):

{txt2stix-1.1.9 → txt2stix-1.1.11}/txt2stix/bundler.py

@@ -133,7 +133,7 @@ class txt2stixBundler:
         "phone-number": None,
         "weakness": None,
     }
-    EXTENSION_DEFINITION_BASE_URL = "https://raw.githubusercontent.com/muchdogesec/stix2extensions/main/extension-definitions"
+    EXTENSION_DEFINITION_BASE_URL = "https://raw.githubusercontent.com/muchdogesec/stix2extensions/main/automodel_generated/extension-definitions"
     ATTACK_FLOW_SMO_URL = "https://github.com/muchdogesec/stix2extensions/raw/refs/heads/main/remote-definitions/attack-flow.json"
     report = None
     identity = None