stix2-editor.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "from jupyter_widget_stixview.widget import StixviewGraph\n",
    "\n",
    "from stix2 import (\n",
    "    Bundle, Indicator, Malware, Relationship,\n",
    "    AttackPattern, Campaign, ThreatActor)\n",
    "\n",
    "\n",
    "def as_bundle(objects):\n",
    "    bundle_obj = Bundle(*objects)\n",
    "    return json.loads(bundle_obj.serialize())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "4add0171fb2248a3abd0d329f8edd5d5",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "StixviewGraph(bundle={'objects': [{'name': 'File hash for malware variant X', 'labels': ['malicious-activity']…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "indicator = Indicator(\n",
    "    name=\"File hash for malware variant X\",\n",
    "    labels=[\"malicious-activity\"],\n",
    "    pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
    "\n",
    "malware = Malware(\n",
    "    name=\"Malware Variant X\",\n",
    "    labels=['remote-access-trojan'])\n",
    "\n",
    "rel1 = Relationship(\n",
    "    source_ref=indicator.id,\n",
    "    relationship_type='indicates',\n",
    "    target_ref=malware.id)\n",
    "\n",
    "objects = [indicator, malware, rel1]\n",
    "\n",
    "StixviewGraph(\n",
    "    bundle=as_bundle(objects),\n",
    "    properties={\"graphHeight\": 300})"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "c15f9d5f901f418eb3548c7c7e1b2713",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "StixviewGraph(bundle={'objects': [{'name': 'File hash for malware variant X', 'labels': ['malicious-activity']…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "indicator = Indicator(\n",
    "    name=\"File hash for malware variant X\",\n",
    "    labels=[\"malicious-activity\"],\n",
    "    pattern=\"[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']\")\n",
    "\n",
    "malware = Malware(\n",
    "    name=\"Malware Variant X\",\n",
    "    labels=['remote-access-trojan'])\n",
    "\n",
    "rel1 = Relationship(\n",
    "    source_ref=indicator.id,\n",
    "    relationship_type='indicates',\n",
    "    target_ref=malware.id)\n",
    "\n",
    "campaign = Campaign(name=\"Campaign Y\")\n",
    "\n",
    "rel2 = Relationship(\n",
    "    source_ref=campaign.id,\n",
    "    relationship_type='uses',\n",
    "    target_ref=malware.id)\n",
    "\n",
    "actor = ThreatActor(\n",
    "    name='Actor Z',\n",
    "    labels=['criminal'])\n",
    "\n",
    "rel3 = Relationship(\n",
    "    source_ref=campaign.id,\n",
    "    relationship_type='attributed-to',\n",
    "    target_ref=actor.id)\n",
    "\n",
    "objects = [indicator, malware, rel1, campaign, rel2, actor, rel3]\n",
    "\n",
    "StixviewGraph(\n",
    "    bundle=as_bundle(objects),\n",
    "    properties={\"graphHeight\": 300})"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "hide_input": false,
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.6"
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {
     "1a4bd92070ed4102b9eb78804ea512e1": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "4add0171fb2248a3abd0d329f8edd5d5": {
      "model_module": "jupyter-widget-stixview",
      "model_module_version": "^1.0.2",
      "model_name": "StixviewGraphModel",
      "state": {
       "_model_module_version": "^1.0.2",
       "_view_module_version": "^1.0.2",
       "bundle": {
        "id": "bundle--5f51dc93-aa6e-49b5-b067-bbcb77631776",
        "objects": [
         {
          "created": "2020-05-04T13:16:09.078Z",
          "id": "indicator--b00f130a-693a-45da-8afd-cae874d93758",
          "labels": [
           "malicious-activity"
          ],
          "modified": "2020-05-04T13:16:09.078Z",
          "name": "File hash for malware variant X",
          "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",
          "type": "indicator",
          "valid_from": "2020-05-04T13:16:09.078226Z"
         },
         {
          "created": "2020-05-04T13:16:09.099Z",
          "id": "malware--ec4ec648-ffb1-438b-8a40-ab5c50b69430",
          "labels": [
           "remote-access-trojan"
          ],
          "modified": "2020-05-04T13:16:09.099Z",
          "name": "Malware Variant X",
          "type": "malware"
         },
         {
          "created": "2020-05-04T13:16:09.099Z",
          "id": "relationship--fa614a85-311a-4bb3-b996-47aaf31e1563",
          "modified": "2020-05-04T13:16:09.099Z",
          "relationship_type": "indicates",
          "source_ref": "indicator--b00f130a-693a-45da-8afd-cae874d93758",
          "target_ref": "malware--ec4ec648-ffb1-438b-8a40-ab5c50b69430",
          "type": "relationship"
         }
        ],
        "spec_version": "2.0",
        "type": "bundle"
       },
       "gist_file": "",
       "gist_id": "",
       "layout": "IPY_MODEL_84e18ebf61f841bb8192a69873720a2d",
       "properties": {
        "graphHeight": 300
       },
       "timeout": 0,
       "url": ""
      }
     },
     "84e18ebf61f841bb8192a69873720a2d": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "c15f9d5f901f418eb3548c7c7e1b2713": {
      "model_module": "jupyter-widget-stixview",
      "model_module_version": "^1.0.2",
      "model_name": "StixviewGraphModel",
      "state": {
       "_model_module_version": "^1.0.2",
       "_view_module_version": "^1.0.2",
       "bundle": {
        "id": "bundle--a3c4bf22-dac2-49d7-9ee9-b26be8d61443",
        "objects": [
         {
          "created": "2020-05-04T13:16:10.952Z",
          "id": "indicator--44db888f-8ab1-4fd3-9eea-c62e75c334f4",
          "labels": [
           "malicious-activity"
          ],
          "modified": "2020-05-04T13:16:10.952Z",
          "name": "File hash for malware variant X",
          "pattern": "[file:hashes.md5 = 'd41d8cd98f00b204e9800998ecf8427e']",
          "type": "indicator",
          "valid_from": "2020-05-04T13:16:10.952308Z"
         },
         {
          "created": "2020-05-04T13:16:10.953Z",
          "id": "malware--0ab7498e-2f0c-4e21-b5c2-d536a0e2ba4c",
          "labels": [
           "remote-access-trojan"
          ],
          "modified": "2020-05-04T13:16:10.953Z",
          "name": "Malware Variant X",
          "type": "malware"
         },
         {
          "created": "2020-05-04T13:16:10.954Z",
          "id": "relationship--24348621-ffe2-4637-b86a-6909e4482b57",
          "modified": "2020-05-04T13:16:10.954Z",
          "relationship_type": "indicates",
          "source_ref": "indicator--44db888f-8ab1-4fd3-9eea-c62e75c334f4",
          "target_ref": "malware--0ab7498e-2f0c-4e21-b5c2-d536a0e2ba4c",
          "type": "relationship"
         },
         {
          "created": "2020-05-04T13:16:10.954Z",
          "id": "campaign--70ca8a90-9436-4aee-88fb-fafdd392d43a",
          "modified": "2020-05-04T13:16:10.954Z",
          "name": "Campaign Y",
          "type": "campaign"
         },
         {
          "created": "2020-05-04T13:16:10.954Z",
          "id": "relationship--e0c91bb5-ee48-4ee1-826d-69e85a6ad8e0",
          "modified": "2020-05-04T13:16:10.954Z",
          "relationship_type": "uses",
          "source_ref": "campaign--70ca8a90-9436-4aee-88fb-fafdd392d43a",
          "target_ref": "malware--0ab7498e-2f0c-4e21-b5c2-d536a0e2ba4c",
          "type": "relationship"
         },
         {
          "created": "2020-05-04T13:16:10.954Z",
          "id": "threat-actor--e6e0e6fa-9a6e-432c-aff8-e75121a29e6d",
          "labels": [
           "criminal"
          ],
          "modified": "2020-05-04T13:16:10.954Z",
          "name": "Actor Z",
          "type": "threat-actor"
         },
         {
          "created": "2020-05-04T13:16:10.954Z",
          "id": "relationship--afd4ca86-1a07-4aa7-95da-3279e6aecbe2",
          "modified": "2020-05-04T13:16:10.954Z",
          "relationship_type": "attributed-to",
          "source_ref": "campaign--70ca8a90-9436-4aee-88fb-fafdd392d43a",
          "target_ref": "threat-actor--e6e0e6fa-9a6e-432c-aff8-e75121a29e6d",
          "type": "relationship"
         }
        ],
        "spec_version": "2.0",
        "type": "bundle"
       },
       "gist_file": "",
       "gist_id": "",
       "layout": "IPY_MODEL_1a4bd92070ed4102b9eb78804ea512e1",
       "properties": {
        "graphHeight": 300
       },
       "timeout": 0,
       "url": ""
      }
     }
    },
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}