1{ 2 "cells": [ 3 { 4 "cell_type": "code", 5 "execution_count": 1, 6 "metadata": { 7 "nbsphinx": "hidden" 8 }, 9 "outputs": [], 10 "source": [ 11 "# Delete this cell to re-enable tracebacks\n", 12 "import sys\n", 13 "ipython = get_ipython()\n", 14 "\n", 15 "def hide_traceback(exc_tuple=None, filename=None, tb_offset=None,\n", 16 " exception_only=False, running_compiled_code=False):\n", 17 " etype, value, tb = sys.exc_info()\n", 18 " value.__cause__ = None # suppress chained exceptions\n", 19 " return ipython._showtraceback(etype, value, ipython.InteractiveTB.get_exception_only(etype, value))\n", 20 "\n", 21 "ipython.showtraceback = hide_traceback" 22 ] 23 }, 24 { 25 "cell_type": "code", 26 "execution_count": 2, 27 "metadata": { 28 "nbsphinx": "hidden" 29 }, 30 "outputs": [], 31 "source": [ 32 "# JSON output syntax highlighting\n", 33 "from __future__ import print_function\n", 34 "from pygments import highlight\n", 35 "from pygments.lexers import JsonLexer, TextLexer\n", 36 "from pygments.formatters import HtmlFormatter\n", 37 "from IPython.display import display, HTML\n", 38 "from IPython.core.interactiveshell import InteractiveShell\n", 39 "\n", 40 "InteractiveShell.ast_node_interactivity = \"all\"\n", 41 "\n", 42 "def json_print(inpt):\n", 43 " string = str(inpt)\n", 44 " formatter = HtmlFormatter()\n", 45 " if string[0] == '{':\n", 46 " lexer = JsonLexer()\n", 47 " else:\n", 48 " lexer = TextLexer()\n", 49 " return HTML('<style type=\"text/css\">{}</style>{}'.format(\n", 50 " formatter.get_style_defs('.highlight'),\n", 51 " highlight(string, lexer, formatter)))\n", 52 "\n", 53 "globals()['print'] = json_print" 54 ] 55 }, 56 { 57 "cell_type": "markdown", 58 "metadata": {}, 59 "source": [ 60 "## Custom STIX Content" 61 ] 62 }, 63 { 64 "cell_type": "markdown", 65 "metadata": {}, 66 "source": [ 67 "### Custom Properties\n", 68 "\n", 69 "Attempting to create a STIX object with properties not defined by the specification will result in an error. Try creating an ``Identity`` object with a custom ``x_foo`` property:" 70 ] 71 }, 72 { 73 "cell_type": "code", 74 "execution_count": 3, 75 "metadata": {}, 76 "outputs": [ 77 { 78 "ename": "ExtraPropertiesError", 79 "evalue": "Unexpected properties for Identity: (x_foo).", 80 "output_type": "error", 81 "traceback": [ 82 "\u001b[0;31mExtraPropertiesError\u001b[0m\u001b[0;31m:\u001b[0m Unexpected properties for Identity: (x_foo).\n" 83 ] 84 } 85 ], 86 "source": [ 87 "from stix2 import Identity\n", 88 "\n", 89 "Identity(name=\"John Smith\",\n", 90 " identity_class=\"individual\",\n", 91 " x_foo=\"bar\")" 92 ] 93 }, 94 { 95 "cell_type": "markdown", 96 "metadata": {}, 97 "source": [ 98 "To create a STIX object with one or more custom properties, pass them in as a dictionary parameter called ``custom_properties``:" 99 ] 100 }, 101 { 102 "cell_type": "code", 103 "execution_count": 4, 104 "metadata": {}, 105 "outputs": [ 106 { 107 "data": { 108 "text/html": [ 109 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 110 ".highlight { background: #f8f8f8; }\n", 111 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 112 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 113 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 114 ".highlight .o { color: #666666 } /* Operator */\n", 115 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 116 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 117 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 118 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 119 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 120 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 121 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 122 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 123 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 124 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 125 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 126 ".highlight .go { color: #888888 } /* Generic.Output */\n", 127 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 128 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 129 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 130 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 131 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 132 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 133 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 134 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 135 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 136 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 137 ".highlight .m { color: #666666 } /* Literal.Number */\n", 138 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 139 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 140 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 141 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 142 ".highlight .no { color: #880000 } /* Name.Constant */\n", 143 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 144 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 145 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 146 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 147 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 148 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 149 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 150 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 151 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 152 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 153 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 154 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 155 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 156 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 157 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 158 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 159 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 160 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 161 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 162 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 163 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 164 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 165 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 166 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 167 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 168 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 169 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 170 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 171 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 172 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 173 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 174 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 175 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 176 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 177 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 178 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n", 179 " <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n", 180 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--a4c49251-0ad1-44e6-8cfc-3dbd75e73fbd"</span><span class=\"p\">,</span>\n", 181 " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:07.107425Z"</span><span class=\"p\">,</span>\n", 182 " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:07.107425Z"</span><span class=\"p\">,</span>\n", 183 " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n", 184 " <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n", 185 " <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n", 186 "<span class=\"p\">}</span>\n", 187 "</pre></div>\n" 188 ], 189 "text/plain": [ 190 "<IPython.core.display.HTML object>" 191 ] 192 }, 193 "execution_count": 4, 194 "metadata": {}, 195 "output_type": "execute_result" 196 } 197 ], 198 "source": [ 199 "identity = Identity(name=\"John Smith\",\n", 200 " identity_class=\"individual\",\n", 201 " custom_properties={\n", 202 " \"x_foo\": \"bar\"\n", 203 " })\n", 204 "print(identity)" 205 ] 206 }, 207 { 208 "cell_type": "markdown", 209 "metadata": {}, 210 "source": [ 211 "Alternatively, setting ``allow_custom`` to ``True`` will allow custom properties without requiring a ``custom_properties`` dictionary." 212 ] 213 }, 214 { 215 "cell_type": "code", 216 "execution_count": 5, 217 "metadata": {}, 218 "outputs": [ 219 { 220 "data": { 221 "text/html": [ 222 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 223 ".highlight { background: #f8f8f8; }\n", 224 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 225 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 226 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 227 ".highlight .o { color: #666666 } /* Operator */\n", 228 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 229 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 230 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 231 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 232 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 233 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 234 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 235 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 236 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 237 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 238 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 239 ".highlight .go { color: #888888 } /* Generic.Output */\n", 240 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 241 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 242 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 243 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 244 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 245 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 246 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 247 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 248 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 249 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 250 ".highlight .m { color: #666666 } /* Literal.Number */\n", 251 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 252 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 253 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 254 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 255 ".highlight .no { color: #880000 } /* Name.Constant */\n", 256 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 257 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 258 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 259 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 260 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 261 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 262 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 263 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 264 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 265 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 266 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 267 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 268 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 269 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 270 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 271 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 272 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 273 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 274 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 275 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 276 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 277 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 278 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 279 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 280 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 281 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 282 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 283 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 284 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 285 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 286 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 287 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 288 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 289 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 290 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 291 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n", 292 " <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n", 293 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--50c33f36-362b-4815-9f97-f3c7f39aa691"</span><span class=\"p\">,</span>\n", 294 " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:15.435425Z"</span><span class=\"p\">,</span>\n", 295 " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:15.435425Z"</span><span class=\"p\">,</span>\n", 296 " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n", 297 " <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span><span class=\"p\">,</span>\n", 298 " <span class=\"nt\">"x_foo"</span><span class=\"p\">:</span> <span class=\"s2\">"bar"</span>\n", 299 "<span class=\"p\">}</span>\n", 300 "</pre></div>\n" 301 ], 302 "text/plain": [ 303 "<IPython.core.display.HTML object>" 304 ] 305 }, 306 "execution_count": 5, 307 "metadata": {}, 308 "output_type": "execute_result" 309 } 310 ], 311 "source": [ 312 "identity2 = Identity(name=\"John Smith\",\n", 313 " identity_class=\"individual\",\n", 314 " x_foo=\"bar\",\n", 315 " allow_custom=True)\n", 316 "print(identity2)" 317 ] 318 }, 319 { 320 "cell_type": "markdown", 321 "metadata": {}, 322 "source": [ 323 "Likewise, when parsing STIX content with custom properties, pass ``allow_custom=True`` to [parse()](../api/stix2.parsing.rst#stix2.parsing.parse):" 324 ] 325 }, 326 { 327 "cell_type": "code", 328 "execution_count": 6, 329 "metadata": {}, 330 "outputs": [ 331 { 332 "data": { 333 "text/html": [ 334 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 335 ".highlight { background: #f8f8f8; }\n", 336 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 337 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 338 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 339 ".highlight .o { color: #666666 } /* Operator */\n", 340 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 341 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 342 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 343 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 344 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 345 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 346 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 347 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 348 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 349 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 350 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 351 ".highlight .go { color: #888888 } /* Generic.Output */\n", 352 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 353 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 354 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 355 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 356 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 357 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 358 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 359 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 360 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 361 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 362 ".highlight .m { color: #666666 } /* Literal.Number */\n", 363 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 364 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 365 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 366 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 367 ".highlight .no { color: #880000 } /* Name.Constant */\n", 368 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 369 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 370 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 371 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 372 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 373 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 374 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 375 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 376 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 377 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 378 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 379 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 380 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 381 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 382 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 383 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 384 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 385 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 386 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 387 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 388 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 389 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 390 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 391 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 392 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 393 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 394 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 395 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 396 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 397 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 398 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 399 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 400 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 401 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 402 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>bar\n", 403 "</pre></div>\n" 404 ], 405 "text/plain": [ 406 "<IPython.core.display.HTML object>" 407 ] 408 }, 409 "execution_count": 6, 410 "metadata": {}, 411 "output_type": "execute_result" 412 } 413 ], 414 "source": [ 415 "from stix2 import parse\n", 416 "\n", 417 "input_string = \"\"\"{\n", 418 " \"type\": \"identity\",\n", 419 " \"spec_version\": \"2.1\",\n", 420 " \"id\": \"identity--311b2d2d-f010-4473-83ec-1edf84858f4c\",\n", 421 " \"created\": \"2015-12-21T19:59:11Z\",\n", 422 " \"modified\": \"2015-12-21T19:59:11Z\",\n", 423 " \"name\": \"John Smith\",\n", 424 " \"identity_class\": \"individual\",\n", 425 " \"x_foo\": \"bar\"\n", 426 "}\"\"\"\n", 427 "identity3 = parse(input_string, allow_custom=True)\n", 428 "print(identity3.x_foo)" 429 ] 430 }, 431 { 432 "cell_type": "markdown", 433 "metadata": {}, 434 "source": [ 435 "To remove a custom properties, use `new_version()` and set that property to `None`." 436 ] 437 }, 438 { 439 "cell_type": "code", 440 "execution_count": 7, 441 "metadata": {}, 442 "outputs": [ 443 { 444 "data": { 445 "text/html": [ 446 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 447 ".highlight { background: #f8f8f8; }\n", 448 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 449 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 450 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 451 ".highlight .o { color: #666666 } /* Operator */\n", 452 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 453 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 454 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 455 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 456 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 457 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 458 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 459 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 460 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 461 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 462 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 463 ".highlight .go { color: #888888 } /* Generic.Output */\n", 464 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 465 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 466 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 467 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 468 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 469 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 470 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 471 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 472 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 473 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 474 ".highlight .m { color: #666666 } /* Literal.Number */\n", 475 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 476 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 477 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 478 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 479 ".highlight .no { color: #880000 } /* Name.Constant */\n", 480 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 481 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 482 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 483 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 484 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 485 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 486 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 487 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 488 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 489 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 490 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 491 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 492 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 493 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 494 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 495 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 496 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 497 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 498 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 499 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 500 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 501 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 502 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 503 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 504 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 505 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 506 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 507 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 508 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 509 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 510 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 511 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 512 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 513 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 514 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 515 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"identity"</span><span class=\"p\">,</span>\n", 516 " <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n", 517 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"identity--311b2d2d-f010-4473-83ec-1edf84858f4c"</span><span class=\"p\">,</span>\n", 518 " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2015-12-21T19:59:11.000Z"</span><span class=\"p\">,</span>\n", 519 " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:29:24.099Z"</span><span class=\"p\">,</span>\n", 520 " <span class=\"nt\">"name"</span><span class=\"p\">:</span> <span class=\"s2\">"John Smith"</span><span class=\"p\">,</span>\n", 521 " <span class=\"nt\">"identity_class"</span><span class=\"p\">:</span> <span class=\"s2\">"individual"</span>\n", 522 "<span class=\"p\">}</span>\n", 523 "</pre></div>\n" 524 ], 525 "text/plain": [ 526 "<IPython.core.display.HTML object>" 527 ] 528 }, 529 "execution_count": 7, 530 "metadata": {}, 531 "output_type": "execute_result" 532 } 533 ], 534 "source": [ 535 "identity4 = identity3.new_version(x_foo=None)\n", 536 "print(identity4)" 537 ] 538 }, 539 { 540 "cell_type": "markdown", 541 "metadata": {}, 542 "source": [ 543 "### Custom STIX Object Types\n", 544 "\n", 545 "To create a custom STIX object type, define a class with the @[CustomObject](../api/v21/stix2.v21.sdo.rst#stix2.v21.sdo.CustomObject) decorator. It takes the type name and a list of property tuples, each tuple consisting of the property name and a property instance. Any special validation of the properties can be added by supplying an ``__init__`` function.\n", 546 "\n", 547 "Let's say zoo animals have become a serious cyber threat and we want to model them in STIX using a custom object type. Let's use a ``species`` property to store the kind of animal, and make that property required. We also want a property to store the class of animal, such as \"mammal\" or \"bird\" but only want to allow specific values in it. We can add some logic to validate this property in ``__init__``." 548 ] 549 }, 550 { 551 "cell_type": "code", 552 "execution_count": 8, 553 "metadata": {}, 554 "outputs": [], 555 "source": [ 556 "from stix2 import CustomObject, properties\n", 557 "\n", 558 "@CustomObject('x-animal', [\n", 559 " ('species', properties.StringProperty(required=True)),\n", 560 " ('animal_class', properties.StringProperty()),\n", 561 "])\n", 562 "class Animal(object):\n", 563 " def __init__(self, animal_class=None, **kwargs):\n", 564 " if animal_class and animal_class not in ['mammal', 'bird', 'fish', 'reptile']:\n", 565 " raise ValueError(\"'%s' is not a recognized class of animal.\" % animal_class)" 566 ] 567 }, 568 { 569 "cell_type": "markdown", 570 "metadata": {}, 571 "source": [ 572 "Now we can create an instance of our custom ``Animal`` type." 573 ] 574 }, 575 { 576 "cell_type": "code", 577 "execution_count": 9, 578 "metadata": {}, 579 "outputs": [ 580 { 581 "data": { 582 "text/html": [ 583 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 584 ".highlight { background: #f8f8f8; }\n", 585 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 586 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 587 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 588 ".highlight .o { color: #666666 } /* Operator */\n", 589 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 590 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 591 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 592 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 593 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 594 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 595 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 596 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 597 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 598 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 599 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 600 ".highlight .go { color: #888888 } /* Generic.Output */\n", 601 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 602 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 603 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 604 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 605 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 606 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 607 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 608 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 609 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 610 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 611 ".highlight .m { color: #666666 } /* Literal.Number */\n", 612 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 613 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 614 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 615 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 616 ".highlight .no { color: #880000 } /* Name.Constant */\n", 617 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 618 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 619 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 620 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 621 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 622 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 623 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 624 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 625 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 626 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 627 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 628 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 629 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 630 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 631 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 632 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 633 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 634 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 635 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 636 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 637 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 638 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 639 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 640 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 641 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 642 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 643 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 644 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 645 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 646 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 647 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 648 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 649 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 650 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 651 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 652 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal"</span><span class=\"p\">,</span>\n", 653 " <span class=\"nt\">"spec_version"</span><span class=\"p\">:</span> <span class=\"s2\">"2.1"</span><span class=\"p\">,</span>\n", 654 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-animal--c7dbda16-360a-4622-b9c7-91f0497167cc"</span><span class=\"p\">,</span>\n", 655 " <span class=\"nt\">"created"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:33:29.856926Z"</span><span class=\"p\">,</span>\n", 656 " <span class=\"nt\">"modified"</span><span class=\"p\">:</span> <span class=\"s2\">"2020-06-24T18:33:29.856926Z"</span><span class=\"p\">,</span>\n", 657 " <span class=\"nt\">"species"</span><span class=\"p\">:</span> <span class=\"s2\">"lion"</span><span class=\"p\">,</span>\n", 658 " <span class=\"nt\">"animal_class"</span><span class=\"p\">:</span> <span class=\"s2\">"mammal"</span>\n", 659 "<span class=\"p\">}</span>\n", 660 "</pre></div>\n" 661 ], 662 "text/plain": [ 663 "<IPython.core.display.HTML object>" 664 ] 665 }, 666 "execution_count": 9, 667 "metadata": {}, 668 "output_type": "execute_result" 669 } 670 ], 671 "source": [ 672 "animal = Animal(species=\"lion\",\n", 673 " animal_class=\"mammal\")\n", 674 "print(animal)" 675 ] 676 }, 677 { 678 "cell_type": "markdown", 679 "metadata": {}, 680 "source": [ 681 "Trying to create an ``Animal`` instance with an ``animal_class`` that's not in the list will result in an error:" 682 ] 683 }, 684 { 685 "cell_type": "code", 686 "execution_count": 10, 687 "metadata": {}, 688 "outputs": [ 689 { 690 "ename": "ValueError", 691 "evalue": "'alien' is not a recognized class of animal.", 692 "output_type": "error", 693 "traceback": [ 694 "\u001b[0;31mValueError\u001b[0m\u001b[0;31m:\u001b[0m 'alien' is not a recognized class of animal.\n" 695 ] 696 } 697 ], 698 "source": [ 699 "Animal(species=\"xenomorph\",\n", 700 " animal_class=\"alien\")" 701 ] 702 }, 703 { 704 "cell_type": "markdown", 705 "metadata": {}, 706 "source": [ 707 "Parsing custom object types that you have already defined is simple and no different from parsing any other STIX object." 708 ] 709 }, 710 { 711 "cell_type": "code", 712 "execution_count": 12, 713 "metadata": {}, 714 "outputs": [ 715 { 716 "data": { 717 "text/html": [ 718 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 719 ".highlight { background: #f8f8f8; }\n", 720 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 721 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 722 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 723 ".highlight .o { color: #666666 } /* Operator */\n", 724 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 725 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 726 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 727 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 728 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 729 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 730 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 731 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 732 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 733 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 734 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 735 ".highlight .go { color: #888888 } /* Generic.Output */\n", 736 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 737 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 738 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 739 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 740 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 741 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 742 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 743 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 744 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 745 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 746 ".highlight .m { color: #666666 } /* Literal.Number */\n", 747 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 748 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 749 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 750 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 751 ".highlight .no { color: #880000 } /* Name.Constant */\n", 752 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 753 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 754 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 755 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 756 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 757 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 758 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 759 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 760 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 761 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 762 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 763 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 764 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 765 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 766 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 767 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 768 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 769 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 770 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 771 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 772 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 773 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 774 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 775 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 776 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 777 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 778 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 779 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 780 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 781 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 782 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 783 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 784 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 785 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 786 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>shark\n", 787 "</pre></div>\n" 788 ], 789 "text/plain": [ 790 "<IPython.core.display.HTML object>" 791 ] 792 }, 793 "execution_count": 12, 794 "metadata": {}, 795 "output_type": "execute_result" 796 } 797 ], 798 "source": [ 799 "input_string2 = \"\"\"{\n", 800 " \"type\": \"x-animal\",\n", 801 " \"id\": \"x-animal--941f1471-6815-456b-89b8-7051ddf13e4b\",\n", 802 " \"created\": \"2015-12-21T19:59:11Z\",\n", 803 " \"modified\": \"2015-12-21T19:59:11Z\",\n", 804 " \"spec_version\": \"2.1\",\n", 805 " \"species\": \"shark\",\n", 806 " \"animal_class\": \"fish\"\n", 807 "}\"\"\"\n", 808 "animal2 = parse(input_string2)\n", 809 "print(animal2.species)" 810 ] 811 }, 812 { 813 "cell_type": "markdown", 814 "metadata": {}, 815 "source": [ 816 "However, parsing custom object types which you have not defined will result in an error:" 817 ] 818 }, 819 { 820 "cell_type": "code", 821 "execution_count": 13, 822 "metadata": {}, 823 "outputs": [ 824 { 825 "ename": "ParseError", 826 "evalue": "Can't parse unknown object type 'x-foobar'! For custom types, use the CustomObject decorator.", 827 "output_type": "error", 828 "traceback": [ 829 "\u001b[0;31mParseError\u001b[0m\u001b[0;31m:\u001b[0m Can't parse unknown object type 'x-foobar'! For custom types, use the CustomObject decorator.\n" 830 ] 831 } 832 ], 833 "source": [ 834 "input_string3 = \"\"\"{\n", 835 " \"type\": \"x-foobar\",\n", 836 " \"id\": \"x-foobar--d362beb5-a04e-4e6b-a030-b6935122c3f9\",\n", 837 " \"created\": \"2015-12-21T19:59:11Z\",\n", 838 " \"modified\": \"2015-12-21T19:59:11Z\",\n", 839 " \"bar\": 1,\n", 840 " \"baz\": \"frob\"\n", 841 "}\"\"\"\n", 842 "parse(input_string3)" 843 ] 844 }, 845 { 846 "cell_type": "markdown", 847 "metadata": {}, 848 "source": [ 849 "### Custom Cyber Observable Types\n", 850 "\n", 851 "Similar to custom STIX object types, use a decorator to create [custom Cyber Observable](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomObservable) types. Just as before, ``__init__()`` can hold additional validation, but it is not necessary." 852 ] 853 }, 854 { 855 "cell_type": "code", 856 "execution_count": 14, 857 "metadata": {}, 858 "outputs": [ 859 { 860 "data": { 861 "text/html": [ 862 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 863 ".highlight { background: #f8f8f8; }\n", 864 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 865 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 866 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 867 ".highlight .o { color: #666666 } /* Operator */\n", 868 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 869 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 870 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 871 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 872 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 873 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 874 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 875 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 876 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 877 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 878 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 879 ".highlight .go { color: #888888 } /* Generic.Output */\n", 880 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 881 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 882 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 883 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 884 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 885 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 886 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 887 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 888 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 889 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 890 ".highlight .m { color: #666666 } /* Literal.Number */\n", 891 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 892 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 893 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 894 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 895 ".highlight .no { color: #880000 } /* Name.Constant */\n", 896 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 897 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 898 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 899 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 900 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 901 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 902 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 903 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 904 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 905 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 906 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 907 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 908 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 909 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 910 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 911 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 912 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 913 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 914 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 915 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 916 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 917 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 918 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 919 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 920 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 921 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 922 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 923 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 924 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 925 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 926 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 927 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 928 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 929 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 930 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 931 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable"</span><span class=\"p\">,</span>\n", 932 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable--fdb5fd26-533e-44f4-9463-e8ade73e08c0"</span><span class=\"p\">,</span>\n", 933 " <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"something"</span><span class=\"p\">,</span>\n", 934 " <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">10</span>\n", 935 "<span class=\"p\">}</span>\n", 936 "</pre></div>\n" 937 ], 938 "text/plain": [ 939 "<IPython.core.display.HTML object>" 940 ] 941 }, 942 "execution_count": 14, 943 "metadata": {}, 944 "output_type": "execute_result" 945 } 946 ], 947 "source": [ 948 "from stix2 import CustomObservable\n", 949 "\n", 950 "@CustomObservable('x-new-observable', [\n", 951 " ('a_property', properties.StringProperty(required=True)),\n", 952 " ('property_2', properties.IntegerProperty()),\n", 953 "])\n", 954 "class NewObservable():\n", 955 " pass\n", 956 "\n", 957 "new_observable = NewObservable(a_property=\"something\",\n", 958 " property_2=10)\n", 959 "print(new_observable)" 960 ] 961 }, 962 { 963 "cell_type": "markdown", 964 "metadata": { 965 "collapsed": true 966 }, 967 "source": [ 968 "Likewise, after the custom Cyber Observable type has been defined, it can be parsed." 969 ] 970 }, 971 { 972 "cell_type": "code", 973 "execution_count": 16, 974 "metadata": {}, 975 "outputs": [ 976 { 977 "data": { 978 "text/html": [ 979 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 980 ".highlight { background: #f8f8f8; }\n", 981 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 982 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 983 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 984 ".highlight .o { color: #666666 } /* Operator */\n", 985 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 986 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 987 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 988 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 989 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 990 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 991 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 992 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 993 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 994 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 995 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 996 ".highlight .go { color: #888888 } /* Generic.Output */\n", 997 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 998 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 999 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1000 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1001 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1002 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1003 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1004 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1005 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1006 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1007 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1008 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1009 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1010 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1011 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1012 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1013 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1014 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1015 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1016 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1017 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1018 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1019 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1020 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1021 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1022 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1023 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1024 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1025 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1026 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1027 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1028 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1029 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1030 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1031 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1032 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1033 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1034 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1035 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1036 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1037 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1038 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1039 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1040 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1041 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1042 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1043 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1044 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1045 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1046 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1047 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>foobaz\n", 1048 "</pre></div>\n" 1049 ], 1050 "text/plain": [ 1051 "<IPython.core.display.HTML object>" 1052 ] 1053 }, 1054 "execution_count": 16, 1055 "metadata": {}, 1056 "output_type": "execute_result" 1057 }, 1058 { 1059 "data": { 1060 "text/html": [ 1061 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1062 ".highlight { background: #f8f8f8; }\n", 1063 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1064 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1065 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1066 ".highlight .o { color: #666666 } /* Operator */\n", 1067 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1068 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1069 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1070 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1071 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1072 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1073 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1074 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1075 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1076 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1077 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1078 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1079 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1080 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1081 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1082 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1083 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1084 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1085 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1086 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1087 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1088 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1089 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1090 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1091 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1092 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1093 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1094 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1095 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1096 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1097 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1098 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1099 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1100 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1101 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1102 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1103 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1104 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1105 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1106 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1107 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1108 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1109 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1110 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1111 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1112 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1113 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1114 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1115 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1116 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1117 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1118 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1119 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1120 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1121 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1122 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1123 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1124 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1125 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1126 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1127 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1128 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1129 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>5\n", 1130 "</pre></div>\n" 1131 ], 1132 "text/plain": [ 1133 "<IPython.core.display.HTML object>" 1134 ] 1135 }, 1136 "execution_count": 16, 1137 "metadata": {}, 1138 "output_type": "execute_result" 1139 } 1140 ], 1141 "source": [ 1142 "from stix2 import ObservedData\n", 1143 "\n", 1144 "input_string4 = \"\"\"{\n", 1145 " \"type\": \"observed-data\",\n", 1146 " \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n", 1147 " \"spec_version\": \"2.1\",\n", 1148 " \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n", 1149 " \"created\": \"2016-04-06T19:58:16.000Z\",\n", 1150 " \"modified\": \"2016-04-06T19:58:16.000Z\",\n", 1151 " \"first_observed\": \"2015-12-21T19:00:00Z\",\n", 1152 " \"last_observed\": \"2015-12-21T19:00:00Z\",\n", 1153 " \"number_observed\": 50,\n", 1154 " \"objects\": {\n", 1155 " \"0\": {\n", 1156 " \"type\": \"x-new-observable\",\n", 1157 " \"a_property\": \"foobaz\",\n", 1158 " \"property_2\": 5\n", 1159 " }\n", 1160 " }\n", 1161 "}\"\"\"\n", 1162 "obs_data = parse(input_string4)\n", 1163 "print(obs_data.objects[\"0\"].a_property)\n", 1164 "print(obs_data.objects[\"0\"].property_2)" 1165 ] 1166 }, 1167 { 1168 "cell_type": "markdown", 1169 "metadata": {}, 1170 "source": [ 1171 "### ID-Contributing Properties for Custom Cyber Observables\n", 1172 "STIX 2.1 Cyber Observables (SCOs) have deterministic IDs, meaning that the ID of a SCO is based on the values of some of its properties. Thus, if multiple cyber observables of the same type have the same values for their ID-contributing properties, then these SCOs will have the same ID. UUIDv5 is used for the deterministic IDs, using the namespace `\"00abedb4-aa42-466c-9c01-fed23315a9b7\"`. A SCO's ID-contributing properties may consist of a combination of required properties and optional properties.\n", 1173 "\n", 1174 "If a SCO type does not have any ID contributing properties defined, or all of the ID-contributing properties are not present on the object, then the SCO uses a randomly-generated UUIDv4. Thus, you can optionally define which of your custom SCO's properties should be ID-contributing properties. Similar to standard SCOs, your custom SCO's ID-contributing properties can be any combination of the SCO's required and optional properties.\n", 1175 "\n", 1176 "You define the ID-contributing properties when defining your custom SCO with the `CustomObservable` decorator. After the list of properties, you can optionally define the list of id-contributing properties. If you do not want to specify any id-contributing properties for your custom SCO, then you do not need to do anything additional.\n", 1177 "\n", 1178 "See the example below:" 1179 ] 1180 }, 1181 { 1182 "cell_type": "code", 1183 "execution_count": 17, 1184 "metadata": {}, 1185 "outputs": [ 1186 { 1187 "data": { 1188 "text/html": [ 1189 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1190 ".highlight { background: #f8f8f8; }\n", 1191 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1192 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1193 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1194 ".highlight .o { color: #666666 } /* Operator */\n", 1195 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1196 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1197 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1198 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1199 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1200 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1201 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1202 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1203 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1204 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1205 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1206 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1207 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1208 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1209 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1210 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1211 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1212 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1213 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1214 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1215 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1216 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1217 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1218 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1219 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1220 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1221 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1222 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1223 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1224 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1225 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1226 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1227 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1228 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1229 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1230 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1231 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1232 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1233 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1234 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1235 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1236 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1237 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1238 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1239 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1240 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1241 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1242 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1243 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1244 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1245 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1246 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1247 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1248 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1249 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1250 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1251 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1252 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1253 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1254 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1255 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1256 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1257 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 1258 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n", 1259 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326"</span><span class=\"p\">,</span>\n", 1260 " <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n", 1261 " <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">2000</span>\n", 1262 "<span class=\"p\">}</span>\n", 1263 "</pre></div>\n" 1264 ], 1265 "text/plain": [ 1266 "<IPython.core.display.HTML object>" 1267 ] 1268 }, 1269 "execution_count": 17, 1270 "metadata": {}, 1271 "output_type": "execute_result" 1272 }, 1273 { 1274 "data": { 1275 "text/html": [ 1276 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1277 ".highlight { background: #f8f8f8; }\n", 1278 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1279 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1280 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1281 ".highlight .o { color: #666666 } /* Operator */\n", 1282 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1283 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1284 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1285 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1286 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1287 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1288 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1289 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1290 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1291 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1292 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1293 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1294 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1295 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1296 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1297 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1298 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1299 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1300 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1301 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1302 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1303 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1304 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1305 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1306 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1307 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1308 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1309 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1310 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1311 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1312 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1313 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1314 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1315 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1316 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1317 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1318 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1319 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1320 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1321 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1322 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1323 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1324 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1325 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1326 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1327 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1328 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1329 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1330 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1331 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1332 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1333 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1334 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1335 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1336 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1337 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1338 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1339 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1340 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1341 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1342 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1343 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1344 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 1345 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n", 1346 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--cafee477-4edc-58fd-81c1-2e23e93f9326"</span><span class=\"p\">,</span>\n", 1347 " <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A property"</span><span class=\"p\">,</span>\n", 1348 " <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n", 1349 "<span class=\"p\">}</span>\n", 1350 "</pre></div>\n" 1351 ], 1352 "text/plain": [ 1353 "<IPython.core.display.HTML object>" 1354 ] 1355 }, 1356 "execution_count": 17, 1357 "metadata": {}, 1358 "output_type": "execute_result" 1359 }, 1360 { 1361 "data": { 1362 "text/html": [ 1363 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1364 ".highlight { background: #f8f8f8; }\n", 1365 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1366 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1367 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1368 ".highlight .o { color: #666666 } /* Operator */\n", 1369 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1370 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1371 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1372 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1373 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1374 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1375 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1376 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1377 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1378 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1379 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1380 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1381 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1382 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1383 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1384 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1385 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1386 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1387 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1388 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1389 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1390 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1391 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1392 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1393 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1394 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1395 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1396 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1397 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1398 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1399 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1400 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1401 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1402 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1403 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1404 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1405 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1406 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1407 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1408 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1409 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1410 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1411 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1412 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1413 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1414 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1415 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1416 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1417 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1418 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1419 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1420 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1421 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1422 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1423 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1424 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1425 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1426 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1427 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1428 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1429 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1430 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1431 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 1432 " <span class=\"nt\">"type"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2"</span><span class=\"p\">,</span>\n", 1433 " <span class=\"nt\">"id"</span><span class=\"p\">:</span> <span class=\"s2\">"x-new-observable-2--2945b948-7361-5204-a630-31b828af920c"</span><span class=\"p\">,</span>\n", 1434 " <span class=\"nt\">"a_property"</span><span class=\"p\">:</span> <span class=\"s2\">"A different property"</span><span class=\"p\">,</span>\n", 1435 " <span class=\"nt\">"property_2"</span><span class=\"p\">:</span> <span class=\"mi\">3000</span>\n", 1436 "<span class=\"p\">}</span>\n", 1437 "</pre></div>\n" 1438 ], 1439 "text/plain": [ 1440 "<IPython.core.display.HTML object>" 1441 ] 1442 }, 1443 "execution_count": 17, 1444 "metadata": {}, 1445 "output_type": "execute_result" 1446 } 1447 ], 1448 "source": [ 1449 "from stix2 import CustomObservable\n", 1450 "\n", 1451 "@CustomObservable('x-new-observable-2', [\n", 1452 " ('a_property', properties.StringProperty(required=True)),\n", 1453 " ('property_2', properties.IntegerProperty()),\n", 1454 "], [\n", 1455 " 'a_property'\n", 1456 "])\n", 1457 "class NewObservable2():\n", 1458 " pass\n", 1459 "\n", 1460 "new_observable_a = NewObservable2(a_property=\"A property\", property_2=2000)\n", 1461 "print(new_observable_a)\n", 1462 "\n", 1463 "new_observable_b = NewObservable2(a_property=\"A property\", property_2=3000)\n", 1464 "print(new_observable_b)\n", 1465 "\n", 1466 "new_observable_c = NewObservable2(a_property=\"A different property\", property_2=3000)\n", 1467 "print(new_observable_c)" 1468 ] 1469 }, 1470 { 1471 "cell_type": "markdown", 1472 "metadata": {}, 1473 "source": [ 1474 "In this example, `a_property` is the only id-contributing property. Notice that the ID for `new_observable_a` and `new_observable_b` is the same since they have the same value for the id-contributing `a_property` property." 1475 ] 1476 }, 1477 { 1478 "cell_type": "markdown", 1479 "metadata": { 1480 "collapsed": true 1481 }, 1482 "source": [ 1483 "### Custom Cyber Observable Extensions\n", 1484 "\n", 1485 "Finally, custom extensions to existing Cyber Observable types can also be created. Just use the @[CustomExtension](../api/v21/stix2.v21.observables.rst#stix2.v21.observables.CustomExtension) decorator. Note that you must provide the Cyber Observable class to which the extension applies. Again, any extra validation of the properties can be implemented by providing an ``__init__()`` but it is not required. Let's say we want to make an extension to the ``File`` Cyber Observable Object:" 1486 ] 1487 }, 1488 { 1489 "cell_type": "code", 1490 "execution_count": 18, 1491 "metadata": {}, 1492 "outputs": [ 1493 { 1494 "data": { 1495 "text/html": [ 1496 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1497 ".highlight { background: #f8f8f8; }\n", 1498 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1499 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1500 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1501 ".highlight .o { color: #666666 } /* Operator */\n", 1502 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1503 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1504 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1505 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1506 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1507 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1508 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1509 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1510 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1511 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1512 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1513 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1514 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1515 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1516 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1517 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1518 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1519 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1520 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1521 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1522 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1523 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1524 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1525 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1526 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1527 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1528 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1529 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1530 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1531 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1532 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1533 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1534 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1535 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1536 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1537 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1538 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1539 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1540 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1541 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1542 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1543 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1544 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1545 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1546 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1547 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1548 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1549 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1550 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1551 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1552 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1553 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1554 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1555 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1556 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1557 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1558 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1559 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1560 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1561 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1562 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1563 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1564 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span><span class=\"p\">{</span>\n", 1565 " <span class=\"nt\">"property1"</span><span class=\"p\">:</span> <span class=\"s2\">"something"</span><span class=\"p\">,</span>\n", 1566 " <span class=\"nt\">"property2"</span><span class=\"p\">:</span> <span class=\"mi\">10</span>\n", 1567 "<span class=\"p\">}</span>\n", 1568 "</pre></div>\n" 1569 ], 1570 "text/plain": [ 1571 "<IPython.core.display.HTML object>" 1572 ] 1573 }, 1574 "execution_count": 18, 1575 "metadata": {}, 1576 "output_type": "execute_result" 1577 } 1578 ], 1579 "source": [ 1580 "from stix2 import File, CustomExtension\n", 1581 "\n", 1582 "@CustomExtension(File, 'x-new-ext', [\n", 1583 " ('property1', properties.StringProperty(required=True)),\n", 1584 " ('property2', properties.IntegerProperty()),\n", 1585 "])\n", 1586 "class NewExtension():\n", 1587 " pass\n", 1588 "\n", 1589 "new_ext = NewExtension(property1=\"something\",\n", 1590 " property2=10)\n", 1591 "print(new_ext)" 1592 ] 1593 }, 1594 { 1595 "cell_type": "markdown", 1596 "metadata": {}, 1597 "source": [ 1598 "Once the custom Cyber Observable extension has been defined, it can be parsed." 1599 ] 1600 }, 1601 { 1602 "cell_type": "code", 1603 "execution_count": 20, 1604 "metadata": {}, 1605 "outputs": [ 1606 { 1607 "data": { 1608 "text/html": [ 1609 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1610 ".highlight { background: #f8f8f8; }\n", 1611 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1612 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1613 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1614 ".highlight .o { color: #666666 } /* Operator */\n", 1615 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1616 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1617 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1618 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1619 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1620 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1621 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1622 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1623 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1624 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1625 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1626 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1627 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1628 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1629 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1630 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1631 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1632 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1633 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1634 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1635 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1636 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1637 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1638 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1639 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1640 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1641 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1642 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1643 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1644 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1645 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1646 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1647 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1648 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1649 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1650 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1651 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1652 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1653 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1654 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1655 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1656 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1657 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1658 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1659 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1660 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1661 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1662 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1663 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1664 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1665 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1666 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1667 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1668 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1669 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1670 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1671 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1672 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1673 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1674 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1675 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1676 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1677 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>bla\n", 1678 "</pre></div>\n" 1679 ], 1680 "text/plain": [ 1681 "<IPython.core.display.HTML object>" 1682 ] 1683 }, 1684 "execution_count": 20, 1685 "metadata": {}, 1686 "output_type": "execute_result" 1687 }, 1688 { 1689 "data": { 1690 "text/html": [ 1691 "<style type=\"text/css\">.highlight .hll { background-color: #ffffcc }\n", 1692 ".highlight { background: #f8f8f8; }\n", 1693 ".highlight .c { color: #408080; font-style: italic } /* Comment */\n", 1694 ".highlight .err { border: 1px solid #FF0000 } /* Error */\n", 1695 ".highlight .k { color: #008000; font-weight: bold } /* Keyword */\n", 1696 ".highlight .o { color: #666666 } /* Operator */\n", 1697 ".highlight .ch { color: #408080; font-style: italic } /* Comment.Hashbang */\n", 1698 ".highlight .cm { color: #408080; font-style: italic } /* Comment.Multiline */\n", 1699 ".highlight .cp { color: #BC7A00 } /* Comment.Preproc */\n", 1700 ".highlight .cpf { color: #408080; font-style: italic } /* Comment.PreprocFile */\n", 1701 ".highlight .c1 { color: #408080; font-style: italic } /* Comment.Single */\n", 1702 ".highlight .cs { color: #408080; font-style: italic } /* Comment.Special */\n", 1703 ".highlight .gd { color: #A00000 } /* Generic.Deleted */\n", 1704 ".highlight .ge { font-style: italic } /* Generic.Emph */\n", 1705 ".highlight .gr { color: #FF0000 } /* Generic.Error */\n", 1706 ".highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */\n", 1707 ".highlight .gi { color: #00A000 } /* Generic.Inserted */\n", 1708 ".highlight .go { color: #888888 } /* Generic.Output */\n", 1709 ".highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */\n", 1710 ".highlight .gs { font-weight: bold } /* Generic.Strong */\n", 1711 ".highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */\n", 1712 ".highlight .gt { color: #0044DD } /* Generic.Traceback */\n", 1713 ".highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */\n", 1714 ".highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */\n", 1715 ".highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */\n", 1716 ".highlight .kp { color: #008000 } /* Keyword.Pseudo */\n", 1717 ".highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */\n", 1718 ".highlight .kt { color: #B00040 } /* Keyword.Type */\n", 1719 ".highlight .m { color: #666666 } /* Literal.Number */\n", 1720 ".highlight .s { color: #BA2121 } /* Literal.String */\n", 1721 ".highlight .na { color: #7D9029 } /* Name.Attribute */\n", 1722 ".highlight .nb { color: #008000 } /* Name.Builtin */\n", 1723 ".highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */\n", 1724 ".highlight .no { color: #880000 } /* Name.Constant */\n", 1725 ".highlight .nd { color: #AA22FF } /* Name.Decorator */\n", 1726 ".highlight .ni { color: #999999; font-weight: bold } /* Name.Entity */\n", 1727 ".highlight .ne { color: #D2413A; font-weight: bold } /* Name.Exception */\n", 1728 ".highlight .nf { color: #0000FF } /* Name.Function */\n", 1729 ".highlight .nl { color: #A0A000 } /* Name.Label */\n", 1730 ".highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */\n", 1731 ".highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */\n", 1732 ".highlight .nv { color: #19177C } /* Name.Variable */\n", 1733 ".highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */\n", 1734 ".highlight .w { color: #bbbbbb } /* Text.Whitespace */\n", 1735 ".highlight .mb { color: #666666 } /* Literal.Number.Bin */\n", 1736 ".highlight .mf { color: #666666 } /* Literal.Number.Float */\n", 1737 ".highlight .mh { color: #666666 } /* Literal.Number.Hex */\n", 1738 ".highlight .mi { color: #666666 } /* Literal.Number.Integer */\n", 1739 ".highlight .mo { color: #666666 } /* Literal.Number.Oct */\n", 1740 ".highlight .sa { color: #BA2121 } /* Literal.String.Affix */\n", 1741 ".highlight .sb { color: #BA2121 } /* Literal.String.Backtick */\n", 1742 ".highlight .sc { color: #BA2121 } /* Literal.String.Char */\n", 1743 ".highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */\n", 1744 ".highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */\n", 1745 ".highlight .s2 { color: #BA2121 } /* Literal.String.Double */\n", 1746 ".highlight .se { color: #BB6622; font-weight: bold } /* Literal.String.Escape */\n", 1747 ".highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */\n", 1748 ".highlight .si { color: #BB6688; font-weight: bold } /* Literal.String.Interpol */\n", 1749 ".highlight .sx { color: #008000 } /* Literal.String.Other */\n", 1750 ".highlight .sr { color: #BB6688 } /* Literal.String.Regex */\n", 1751 ".highlight .s1 { color: #BA2121 } /* Literal.String.Single */\n", 1752 ".highlight .ss { color: #19177C } /* Literal.String.Symbol */\n", 1753 ".highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */\n", 1754 ".highlight .fm { color: #0000FF } /* Name.Function.Magic */\n", 1755 ".highlight .vc { color: #19177C } /* Name.Variable.Class */\n", 1756 ".highlight .vg { color: #19177C } /* Name.Variable.Global */\n", 1757 ".highlight .vi { color: #19177C } /* Name.Variable.Instance */\n", 1758 ".highlight .vm { color: #19177C } /* Name.Variable.Magic */\n", 1759 ".highlight .il { color: #666666 } /* Literal.Number.Integer.Long */</style><div class=\"highlight\"><pre><span></span>50\n", 1760 "</pre></div>\n" 1761 ], 1762 "text/plain": [ 1763 "<IPython.core.display.HTML object>" 1764 ] 1765 }, 1766 "execution_count": 20, 1767 "metadata": {}, 1768 "output_type": "execute_result" 1769 } 1770 ], 1771 "source": [ 1772 "input_string5 = \"\"\"{\n", 1773 " \"type\": \"observed-data\",\n", 1774 " \"id\": \"observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf\",\n", 1775 " \"spec_version\": \"2.1\",\n", 1776 " \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\",\n", 1777 " \"created\": \"2016-04-06T19:58:16.000Z\",\n", 1778 " \"modified\": \"2016-04-06T19:58:16.000Z\",\n", 1779 " \"first_observed\": \"2015-12-21T19:00:00Z\",\n", 1780 " \"last_observed\": \"2015-12-21T19:00:00Z\",\n", 1781 " \"number_observed\": 50,\n", 1782 " \"objects\": {\n", 1783 " \"0\": {\n", 1784 " \"type\": \"file\",\n", 1785 " \"name\": \"foo.bar\",\n", 1786 " \"hashes\": {\n", 1787 " \"SHA-256\": \"35a01331e9ad96f751278b891b6ea09699806faedfa237d40513d92ad1b7100f\"\n", 1788 " },\n", 1789 " \"extensions\": {\n", 1790 " \"x-new-ext\": {\n", 1791 " \"property1\": \"bla\",\n", 1792 " \"property2\": 50\n", 1793 " }\n", 1794 " }\n", 1795 " }\n", 1796 " }\n", 1797 "}\"\"\"\n", 1798 "obs_data2 = parse(input_string5)\n", 1799 "print(obs_data2.objects[\"0\"].extensions[\"x-new-ext\"].property1)\n", 1800 "print(obs_data2.objects[\"0\"].extensions[\"x-new-ext\"].property2)" 1801 ] 1802 } 1803 ], 1804 "metadata": { 1805 "kernelspec": { 1806 "display_name": "Python 3", 1807 "language": "python", 1808 "name": "python3" 1809 }, 1810 "language_info": { 1811 "codemirror_mode": { 1812 "name": "ipython", 1813 "version": 3 1814 }, 1815 "file_extension": ".py", 1816 "mimetype": "text/x-python", 1817 "name": "python", 1818 "nbconvert_exporter": "python", 1819 "pygments_lexer": "ipython3", 1820 "version": "3.9.0a6" 1821 } 1822 }, 1823 "nbformat": 4, 1824 "nbformat_minor": 2 1825} 1826