Package: misp-stix
MISP-STIX - Python library to handle the conversion between MISP standard and STIXMISP-STIX-converter is a Python library (>=3.8) to handle all the conversions between theMISP standard formatand STIX formats.The package is available asmisp-stixin PyPI.FeaturesMISP standard format conversion to STIX 1.x (1.1.1 and 1.2)MISP standard format conversion to STIX 2.x (2.0 and 2.1)MapsMISP ObjectsandMISP galaxieswithrespective semantically similar objectsSTIX to MISP standard formatProvides an extendable library for mapping and facilitate extensionThis library is used by theMISP core softwareto perform STIX conversion and serving as a useful tool for anyone looking for a clean way of converting between the MISP standard format and various STIX versions (1.1.1, 1.2, 2.0, 2.1).A completedocumentation is availableincluding the mappings between the different formats.Install from pipIt is strongly recommended to use a virtual environmentIf you want to know more about virtual environments,python has you coveredFrom the current repository:pip3 install misp-stixPackage details at PyPI:misp-stixInstall the latest version from the repository for development purposesNote: poetry is required; e.g.,pip3 install poetrygit clone https://github.com/MISP/misp-stix.git && cd misp-stix
git submodule update --init
poetry installIf you already have poetry face any issue with it while installing or updating misp-stix with it, you can trypip3 install -U poetryto make sure you have a version >= 1.2Running the testsTests for MISP format export as STIX 1.1.1 & 1.2:poetryrunpytesttests/test_stix1_export.pyTests for MISP format export as STIX 2.0:poetryrunpytesttests/test_stix20_export.pyTests for MISP format export as STIX 2.1:poetryrunpytesttests/test_stix21_export.pyUsageCommand-line Usagemisp_stix_converter export --version 2.1 -f tests/test_events_collection_1.jsonParametersusage:misp_stix_converter[-h][--debug]{export,import}...

ConvertMISP<->STIX

options:-h,--helpshowthishelpmessageandexit--debugShowerrorsandwarnings

Mainfeature:{export,import}exportExportMISPtoSTIX-try`misp_stix_converterexport-h`formorehelp.importImportSTIXtoMISP-try`misp_stix_converterimport-h`formorehelp.Export parametersusage:misp_stix_converterexport[-h]-fFILE[FILE...]-v{1.1.1,1.2,2.0,2.1}[-s][-m][--output_dirOUTPUT_DIR][-oOUTPUT_NAME][--level{attribute,event}][--format{json,xml}][-nNAMESPACE][-orgORG]options:-h,--helpshowthishelpmessageandexit-fFILE[FILE...],--fileFILE[FILE...]Pathtothefile(s)toconvert.-v{1.1.1,1.2,2.0,2.1},--version{1.1.1,1.2,2.0,2.1}STIXspecificversion.-s,--single_outputProduceonlyoneresultfile(incaseofmultipleinputfile).-m,--in_memoryStoreresultinmemory(incaseofmultipleresultfiles)insteadofstoringitintmpfiles.--output_dirOUTPUT_DIROutputpath-usedinthecaseofmultipleinputfileswhenthe`single_output`argumentisnotused.-oOUTPUT_NAME,--output_nameOUTPUT_NAMEOutputfilename-usedinthecaseofasingleinputfileorwhenthe`single_output`argumentisused.

STIX1specificarguments:--level{attribute,event}MISPdatastructurelevel.--format{json,xml}STIX1format.-nNAMESPACE,--namespaceNAMESPACENamespacetobeusedintheSTIX1header.-orgORGOrganisationnametobeusedintheSTIX1header.Import parametersusage:misp_stix_converterimport[-h]-fFILE[FILE...]-v{1,2}[-s][-oOUTPUT_NAME][--output_dirOUTPUT_DIR][-dDISTRIBUTION][-sgSHARING_GROUP][--galaxies_as_tags]options:-h,--helpshowthishelpmessageandexit-fFILE[FILE...],--fileFILE[FILE...]Pathtothefile(s)toconvert.-v{1,2},--version{1,2}STIXmajorversion.-s,--single_outputProduceonlyoneMISPeventperSTIXfile(incaseofmultipleReport,GroupingorIncidentobjects).-oOUTPUT_NAME,--output_nameOUTPUT_NAMEOutputfilename-usedinthecaseofasingleinputfileorwhenthe`single_output`argumentisused.--output_dirOUTPUT_DIROutputpath-usedinthecaseofmultipleinputfileswhenthe`single_output`argumentisnotused.-dDISTRIBUTION,--distributionDISTRIBUTIONDistributionlevelfortheimportedMIPScontent.-sgSHARING_GROUP,--sharing_groupSHARING_GROUPSharinggroupIDwhendistributionis4.--galaxies_as_tagsImportMISPGalaxiesastagnamesinsteadofthestandardGalaxyformat.In Python scriptsGiven a MISP Event (with its metadata fields, attributes, objects, galaxies and tags), declared in aneventvariable in Python dict format, you can get the result of a conversion into one of the supported STIX versions:Convert a MISP Event in STIX1:frommisp_stix_converterimportMISPtoSTIX1EventsParserparser=MISPtoSTIX1EventsParser('MISP-Project',# Example of Org name'1.1.1'# STIX1 version (1.1.1 or 1.2))parser.parse_misp_event(event)stix_package=parser.stix_packageConvert a MISP Event in STIX1 using directly its file name:frommisp_stix_converterimportmisp_to_stix1response=misp_to_stix1(filename,# file name of the file containing a MISP Event'xml',# return format (XML or JSON)'1.1.1'# STIX1 version (1.1.1 or 1.2))# if everything went well, response is a dictionary where `success` = 1The resulting STIX1 Package is then available in afilename.outfileConvert a MISP Event in STIX2:# for STIX 2.0frommisp_stix_converterimportMISPtoSTIX20Parser# for STIX 2.1frommisp_stix_converterimportMISPtoSTIX21Parserparser20=MISPtoSTIX20Parser()parser20.parse_misp_event(event)parser21=MISPtoSTIX21Parser()parser21.parse_misp_event(event)# To get the list of parsed STIX objectsstix_20_objects=parser20.stix_objectsstix_21_objects=parser21.stix_objects# To get the list of parser STIX objects within a STIX 2.0 or 2.1 Bundlebundle20=parser20.bundlebundle21=parser21.bundleConvert a MISP Event in STIX2 using directly its file name:frommisp_stix_converterimportmisp_to_stix2response_20=misp_to_stix2(filename,version='2.0')response_21=misp_to_stix2(filename,version='2.1')# Again response_20 & response_21 have a `success` field equal to 1 if everything went wellThe resulting STIX2 Bundle is the available in afilename.outfile, or you can define the output name with theoutput_nameargument.If you get some MISP collection of data, it is also possible to convert it straight into some STIX format:frommisp_stix_converterimportMISPtoSTIX1EventsParser,MISPtoSTIX20Parser,MISPtoSTIX21Parserfilename=_PATH_TO_YOUR_FILE_CONTAINING_MISP_FORMAT_parser1=MISPtoSTIX1EventsParser('MISP','1.1.1')parser1.parse_json_content(filename)stix_package=parser1.stix_packageparser20=MISPtoSTIX20Parser()parser20.parse_json_content(filename)stix_20_objects=parser20.stix_objectsbundle20=parser20.bundleparser21=MISPtoSTIX21Parser()parser21.parse_json_content(filename)stix_21_objects=parser21.stix_objectsbundle21=parser21.bundleBut in order to parse multiple data collections, you can also use the following helpers:frommisp_stix_converterimportmisp_event_collection_to_stix1,misp_event_collection_to_stix2input_filenames=[filenameforfilenameinPath(_PATH_TO_YOUR_MISP_FILES_).glob('*.json')]stix1_response=misp_event_collection_to_stix1(*input_filenames,output_name=output_filename,# path to the file where the results are going to be writtenreturn_format='xml',# STIX1 return format (XML or JSON)version='1.1.1'# STIX1 version (1.1.1 or 1.2))stix20_response=misp_event_collection_to_stix2(*input_filenames,version='2.0'# STIX 2 version)stix21_response=misp_event_collection_to_stix2_1(*input_filenames,version='2.1',single_output=True,# For a single resulting fileoutput_name=output_file_name,# path to the file where the results are going to be writtenin_memory=True# To keep results in memory before writing the full converted content at the end in the result file)Again, all the responses should have asuccessfield equal to 1 and the resulting STIX1 Package and STIX 2.0 & 2.1 Bundles are available in the specific output file names.Samples and examplesVarious examples are provided and used by the different tests scripts in thetestsdirectory.
Those example files are showing the results of MISP format exported in the various supported STIX formats.MISP <--> STIX MappingA specific documentation concerning the mapping between MISP and the various supported STIX versions is also provided in thedocumentationdirectory.
You can find there all the different cases illustrated with examples.Licensemisp-stix is released under a BSD 2-Clause "Simplified" License allow easy reuse with other libraries.Copyright 2019-2023 Christian Studer
Copyright 2019-2023 CIRCL - Computer Incident Response Center Luxembourg c/o "security made in Lëtzebuerg" (SMILE) g.i.e.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.