You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was updating my python wrapper to collect information in STIX from the public TAXII server and started to do some exploring of each technology-domain. I decided to query the enterprise collection and explore the available objects in it:
Im using a Jupyter Notebook:
In [27]: from taxii2client import Collection
In [28]: from stix2 import TAXIICollectionSource, Filter
In [29]: ATTCK_STIX_COLLECTIONS = "https://cti-taxii.mitre.org/stix/collections/"
In [30]: ENTERPRISE_ATTCK = "95ecc380-afe9-11e4-9b6c-751b66dd541e"
In [31]: ENTERPRISE_COLLECTION = Collection(ATTCK_STIX_COLLECTIONS + ENTERPRISE_ATTCK + "/")
In [32]: TC_ENTERPRISE_SOURCE = TAXIICollectionSource(ENTERPRISE_COLLECTION)
In [33]: enterprise_objects = TC_ENTERPRISE_SOURCE.query()
In [34]: type(enterprise_objects)
Out[34]: list
In [35]: enterprise_list = []
In [36]: for o in enterprise_objects:
...: enterprise_list.append(o['type'])
...:
In [37]: from collections import Counter
In [38]: Counter(enterprise_list)
Out[38]:
Counter({'relationship': 4852,
'course-of-action': 241,
'attack-pattern': 244,
'malware': 278,
'tool': 56,
'intrusion-set': 88,
'x-mitre-tactic': 12,
'x-mitre-matrix': 1,
'identity': 1,
'marking-definition': 1})
In [39]:
As you can see in output 38, I was able to aggregate each object and show the number of times the object is present.
Now, when I perform a loop through the enterprise available objects and inspect the type of data I am dealing with, I get STIX object types which is what I expect. However, when I inspect the type of the object x-mitre-tactic, it returns a dict type.
In [41]: for e in enterprise_objects:
...: if e['type'] == "x-mitre-tactic":
...: print(e['name'])
...: print(type(e))
...: print("-----")
...:
Impact
<class 'dict'>
-----
Credential Access
<class 'dict'>
-----
Defense Evasion
<class 'dict'>
-----
Initial Access
<class 'dict'>
-----
Command and Control
<class 'dict'>
-----
Exfiltration
<class 'dict'>
-----
Privilege Escalation
<class 'dict'>
-----
Collection
<class 'dict'>
-----
Execution
<class 'dict'>
-----
Persistence
<class 'dict'>
-----
Discovery
<class 'dict'>
-----
Lateral Movement
<class 'dict'>
-----
Is there a reason why the custom STIX objects are of type dict and not STIX?
Thank you in advance!
The text was updated successfully, but these errors were encountered:
Hi @Cyb3rWard0g, good question. The reason why you see this is because you are dealing with custom objects not defined (or registered) on the stix2 library. In order to not fail hard, the library will just treat them as regular dictionaries.
If you want or need custom object instances you would need to define and register them (examples here). The extra benefit comes from validating your instances, but as far as I know extensions for x-mitre-tactic and x-mitre-matrix are not avaiable.
Are you encountering a specific issue or just curious about the approach?
Good afternoon Team,
I was updating my python wrapper to collect information in STIX from the public TAXII server and started to do some exploring of each technology-domain. I decided to query the enterprise collection and explore the available objects in it:
Im using a Jupyter Notebook:
As you can see in output 38, I was able to aggregate each object and show the number of times the object is present.
Now, when I perform a loop through the enterprise available objects and inspect the type of data I am dealing with, I get STIX object types which is what I expect. However, when I inspect the type of the object
x-mitre-tactic
, it returns adict
type.Is there a reason why the custom STIX objects are of type
dict
and not STIX?Thank you in advance!
The text was updated successfully, but these errors were encountered: