[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-users] Java STIX 2.x Libary
Hi All! I have just added support for relationships with STIX in the Java lib. example ``` {  "type": "bundle",  "id": "bundle--f428f07f-4efe-4980-9f47-74d946826c69",  "spec_version": "2.0",  "objects": [   {    "type": "attack-pattern",    "id": "attack-pattern--cb3010c8-f36c-4dc3-bf3d-8c1ffeb5e1cf",    "created": "2018-11-22T22:26:43.159Z",    "modified": "2018-11-25T22:26:43.159Z",    "revoked": false,    "object_marking_refs": [     "marking-definition--6139cfd0-7d2f-4389-b7e3-e97836888268"    ],    "granular_markings": [     {      "selectors": [       "pattern1",       "pattern2",       "pattern3"      ],      "marking_ref": "marking-definition--b4ab8f5b-f812-49c5-a2b2-b168a0ba236d"     }    ],    "name": "some pattern",    "kill_chain_phases": [     {      "kill_chain_name": "Chain1",      "phase_name": "phase1"     },     {      "kill_chain_name": "Chain1",      "phase_name": "phase2"     }    ],    "x_someCustomKey": "My custom value",    "x_someOtherCustom_key": 3939   },   {    "type": "observed-data",    "id": "observed-data--e3d14217-fc58-47bb-b5fb-b67d6ca78db3",    "created": "2018-11-22T22:26:43.221Z",    "modified": "2018-11-22T22:26:43.221Z",    "revoked": false,    "object_marking_refs": [     "marking-definition--39ceb120-7777-4e13-888e-95efb6c99a31"    ],    "first_observed": "2018-11-22T22:26:43.209Z",    "last_observed": "2018-11-22T22:26:43.209Z",    "number_observed": 3,    "objects": {     "some artifact": {      "type": "artifact",      "url": "someURL"     },     "some AS": {      "type": "autonomous-system",      "number": 5,      "rir": "someRIR"     }    }   },   {    "type": "marking-definition",    "id": "marking-definition--39ceb120-7777-4e13-888e-95efb6c99a31",    "created": "2018-11-22T22:26:43.208Z",    "granular_markings": [     {      "selectors": [       "marking-pattern1",       "pattern2",       "pattern3"      ],      "marking_ref": "marking-definition--b4ab8f5b-f812-49c5-a2b2-b168a0ba236d"     }    ],    "definition_type": "statement",    "definition": {     "statement": "Internal review of data allows for sharing as per ABC-009 Standard"    }   },   {    "type": "marking-definition",    "id": "marking-definition--b4ab8f5b-f812-49c5-a2b2-b168a0ba236d",    "created": "2018-11-22T22:26:43.199Z",    "definition_type": "tlp",    "definition": {     "tlp": "red"    }   },   {    "type": "relationship",    "id": "relationship--fb64d173-3478-4eb9-abae-c580cf92454c",    "created": "2018-11-22T22:26:43.242Z",    "modified": "2018-11-22T22:26:43.242Z",    "revoked": false,    "relationship_type": "targets",    "source": "attack-pattern--cb3010c8-f36c-4dc3-bf3d-8c1ffeb5e1cf",    "target": "identity--16b669a9-91ef-492d-852c-9249695a09f4"   }  ] } ``` I am hoping some of the community can provide some interesting âcomplexitiesâ for relationships for me to test again. If you have some scenarios of complexity please share! All of the relationships are typed checked and validated per SDO. So it should generated fully spec compliant relationships. as a extra helper to maintain sanity I have added the "bundle.autoDetectBundleObjects()â method. This will traverse the nested relationships and objects inside of each objects in the bundle and add any nested content into the bundle at the parent level as per the spec. The âsanityâ aspect is that if you are building a complex object with many relationships and nested objects, you can build these all inline without the need to generate them as individual bundle items. So you could have a âattack-patternâ with 5 ârelated-toâ, 5 object markings, and 5 granular markings. Âyou would just have to write âbundle.addObjects(myAttackPattern)â and run the âbundle.autoDetectBundleObjects()â method, and it will detect all of the nested 15 objects and add them into the bundle as per the spec. Thanks From:ÂTrey Darley <trey@kingfisherops.com> Reply:ÂTrey Darley <trey@kingfisherops.com> Date:ÂNovember 21, 2018 at 5:50:17 PM To:ÂStephen Russett <stephen@digitalstate.ca> Cc:Âcti-users@lists.oasis-open.org <cti-users@lists.oasis-open.org> Subject: Re: [cti-users] Java STIX 2.x Libary
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]