memory

Python STIX2 Memory Source/Sink

class MemorySink(stix_data=None, allow_custom=True, version=None, _store=False)

Interface for adding/pushing STIX objects to an in-memory dictionary.

Designed to be paired with a MemorySource, together as the two components of a MemoryStore.

Parameters:
  • stix_data (dict OR list) – valid STIX 2.0 content in bundle or a list.
  • _store (bool) – whether the MemorySink is a part of a MemoryStore, in which case “stix_data” is a direct reference to shared memory with DataSource. Not user supplied
  • allow_custom (bool) – whether to allow custom objects/properties when exporting STIX content to file. Default: True.
  • version (str) – If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the “spec_version” property.
_data

the in-memory dict that holds STIX objects. If part of a MemoryStore, the dict is shared with a MemorySource

Type:dict
add(stix_data, version=None)

Add STIX objects to MemoryStore/Sink.

Adds STIX objects to an in-memory dictionary for fast lookup. Recursive function, breaks down STIX Bundles and lists.

Parameters:
  • store – A MemoryStore, MemorySink or MemorySource object.
  • stix_data (list OR dict OR STIX object) – STIX objects to be added
  • allow_custom (bool) – Whether to allow custom properties as well unknown custom objects. Note that unknown custom objects cannot be parsed into STIX objects, and will be returned as is. Default: False.
  • version (str) – Which STIX2 version to lock the parser to. (e.g. “2.0”, “2.1”). If None, the library makes the best effort to figure out the spec representation of the object.
save_to_file(path, encoding='utf-8')

Write SITX objects from in-memory dictionary to JSON file, as a STIX Bundle. If a directory is given, the Bundle ‘id’ will be used as filename. Otherwise, the provided value will be used.

Parameters:
  • path (str) – file path to write STIX data to.
  • encoding (str) – The file encoding. Default utf-8.
class MemorySource(stix_data=None, allow_custom=True, version=None, _store=False)

Interface for searching/retrieving STIX objects from an in-memory dictionary.

Designed to be paired with a MemorySink, together as the two components of a MemoryStore.

Parameters:
  • stix_data (dict OR list OR STIX object) – valid STIX 2.0 content in bundle or list.
  • _store (bool) – if the MemorySource is a part of a MemoryStore, in which case “stix_data” is a direct reference to shared memory with DataSink. Not user supplied
  • allow_custom (bool) – whether to allow custom objects/properties when importing STIX content from file. Default: True.
  • version (str) – If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the “spec_version” property.
_data

the in-memory dict that holds STIX objects. If part of a MemoryStore, the dict is shared with a MemorySink

Type:dict
all_versions(stix_id, _composite_filters=None)

Retrieve STIX objects from in-memory dict via STIX ID, all versions of it.

Parameters:
  • stix_id (str) – The STIX ID of the STIX 2 object to retrieve.
  • _composite_filters (FilterSet) – collection of filters passed from the parent CompositeDataSource, not user supplied
Returns:

(list) – list of STIX objects that have the supplied ID.

get(stix_id, _composite_filters=None)

Retrieve STIX object from in-memory dict via STIX ID.

Parameters:
  • stix_id (str) – The STIX ID of the STIX object to be retrieved.
  • _composite_filters (FilterSet) – collection of filters passed from the parent CompositeDataSource, not user supplied
Returns:

(STIX object) – STIX object that has the supplied ID.

load_from_file(file_path, version=None, encoding='utf-8')

Load STIX data from JSON file.

File format is expected to be a single JSON STIX object or JSON STIX bundle.

Parameters:path (str) – file path to load STIX data from
query(query=None, _composite_filters=None)

Search and retrieve STIX objects based on the complete query.

A “complete query” includes the filters from the query, the filters attached to this MemorySource, and any filters passed from a CompositeDataSource (i.e. _composite_filters).

Parameters:
  • query (list) – list of filters to search on
  • _composite_filters (FilterSet) – collection of filters passed from the CompositeDataSource, not user supplied
Returns:

(list) – list of STIX objects that match the supplied query.

class MemoryStore(stix_data=None, allow_custom=True, version=None)

Interface to an in-memory dictionary of STIX objects.

MemoryStore is a wrapper around a paired MemorySink and MemorySource.

Note: It doesn’t make sense to create a MemoryStore by passing in existing MemorySource and MemorySink because there could be data concurrency issues. As well, just as easy to create new MemoryStore.

Parameters:
  • stix_data (list OR dict OR STIX object) – STIX content to be added
  • allow_custom (bool) – whether to allow custom STIX content. Only applied when export/input functions called, i.e. load_from_file() and save_to_file(). Defaults to True.
_data

the in-memory dict that holds STIX objects

Type:dict
source

MemorySource

Type:MemorySource
sink

MemorySink

Type:MemorySink
load_from_file(*args, **kwargs)

Load STIX data from JSON file.

File format is expected to be a single JSON STIX object or JSON STIX bundle.

Parameters:path (str) – file path to load STIX data from
save_to_file(*args, **kwargs)

Write SITX objects from in-memory dictionary to JSON file, as a STIX Bundle. If a directory is given, the Bundle ‘id’ will be used as filename. Otherwise, the provided value will be used.

Parameters:
  • path (str) – file path to write STIX data to.
  • encoding (str) – The file encoding. Default utf-8.