Package: openstix
OpenSTIXOpenSTIX is anunofficial STIX 2.1 library and toolkitbuilt upon the foundations of theSTIX2 library, aimed at enhancing the efficiency and productivity of cybersecurity professionals. It's developed and maintained by AbuseTotal, a startup committed to delivering high-quality software solutions in the cybersecurity domain.FeaturesModular Design: Organizes the functionalities provided by STIX2 library into modules for easy consumption and extension.Workspace Class: Extends theEnvironmentclass into aWorkspaceclass to facilitate seamless creation, removal, and management of STIX SDOs (Structured Data Objects) based on contributing properties.Static Namespace Management: Allows users to define a static namespace for their organization, ensuring consistent identification and management across STIX objects.Contributing Properties-based ID Management: Enables operations on STIX SDOs with identical IDs, governed by specific contributing properties.Built-in Datasets: Provides ready-to-use datasets including MITRE frameworks, geolocations, custom TLP markings, and industries to expedite the analytical process.Custom Objects and Extensions: Offers custom objects and extensions to assist analysts with additional informational resources such as Whois and DNS-Records.InstallationpipinstallopenstixUsageImport the necessary modules and get started with creating and managing STIX objects within your defined workspace.Start workspacefromopenstix.toolkit.workspaceimportWorkspace# Create a new workspace with your organization's namespaceworkspace=Workspace(namespace="<your-namespace-uuid>")Parse and load stix data into workspacedata="""{"type": "bundle","id": "bundle--0ef10afc-6a6b-4df7-bc4b-099977bfcba8","objects": [{"type": "domain-name","spec_version": "2.1","id": "domain-name--9076dffc-9b97-55f6-a720-bc115b25fe31","value": "openstix.dev"}]}"""# Parse STIX data and load automatically the objects in workspaceworkspace.parse(data)Create SCO within workspacefromopenstix.objectsimportDomainName# Add STIX observable object (SCO)domain=self.workspace.create(Domain,value="abusetotal.com")Remove object from workspace# Remove STIX observable object (SCO)self.workspace.remove(domain.id)Create SDO within workspacefromopenstix.objectsimportMalware# Add STIX domain object (SDO)self.workspace.create(Malware,name="Malicious",is_family=False)Filter workspace objects using presets filtersfromopenstix.toolkit.filters.presetsimportMALWARE_FILTER# Filter objects using presetsmalwares=self.workspace.query(MALWARE_FILTER)Download STIX datasets$openstixdatasetsdownload--allGet MITRE TTP using MITRE DatasetsNote:make sure you have downloaded the dataset using openstix clifromopenstix.datasetsimportMITREDatasetdataset=MITREDataset()dataset.load()# Use Attack Pattern objects from MITRE Datasetattack_pattern=dataset.attack_pattern("T1090")Get country and regions objects using GeoLocation DatasetsNote:make sure you have downloaded the dataset using openstix clifromopenstix.datasetsimportGeoLocationsDatasetdataset=GeoLocationsDataset()dataset.load()# Use Location objects from GeoLocation Datasetcountry=dataset.country("PT")region=dataset.region("Europe")ContributingWe welcome contributions to OpenSTIX! Whether you're reporting bugs, proposing new features, or contributing code, we appreciate your help. Please make sure to read our Contributing Guidelines before making a contribution.LicenseOpenSTIX is licensed under the Apache 2.0.ContactFor any inquiries, issues, or support related to OpenSTIX, feel free to reach out to us atsupport@abusetotal.com.AcknowledgementsOpenSTIX is an initiative by AbuseTotal to foster the development of cybersecurity tools and libraries. We thank the OASIS Cyber Threat Intelligence Technical Committee and all STIX community for laying down the robust foundation upon which OpenSTIX is built.