memory¶
Python STIX2 Memory Source/Sink
-
class
MemorySink
(stix_data=None, allow_custom=True, version=None, _store=False)¶ Interface for adding/pushing STIX objects to an in-memory dictionary.
Designed to be paired with a MemorySource, together as the two components of a MemoryStore.
Parameters: - stix_data (dict OR list) – valid STIX 2.0 content in bundle or a list.
- _store (bool) – whether the MemorySink is a part of a MemoryStore, in which case “stix_data” is a direct reference to shared memory with DataSource. Not user supplied
- allow_custom (bool) – whether to allow custom objects/properties when exporting STIX content to file. Default: True.
- version (str) – If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the “spec_version” property.
-
_data
¶ the in-memory dict that holds STIX objects. If part of a MemoryStore, the dict is shared with a MemorySource
Type: dict
-
add
(stix_data, version=None)¶ Add STIX objects to MemoryStore/Sink.
Adds STIX objects to an in-memory dictionary for fast lookup. Recursive function, breaks down STIX Bundles and lists.
Parameters: - store – A MemoryStore, MemorySink or MemorySource object.
- stix_data (list OR dict OR STIX object) – STIX objects to be added
- allow_custom (bool) – Whether to allow custom properties as well unknown custom objects. Note that unknown custom objects cannot be parsed into STIX objects, and will be returned as is. Default: False.
- version (str) – Which STIX2 version to lock the parser to. (e.g. “2.0”, “2.1”). If None, the library makes the best effort to figure out the spec representation of the object.
-
save_to_file
(path, encoding='utf-8')¶ Write SITX objects from in-memory dictionary to JSON file, as a STIX Bundle. If a directory is given, the Bundle ‘id’ will be used as filename. Otherwise, the provided value will be used.
Parameters: - path (str) – file path to write STIX data to.
- encoding (str) – The file encoding. Default utf-8.
-
class
MemorySource
(stix_data=None, allow_custom=True, version=None, _store=False)¶ Interface for searching/retrieving STIX objects from an in-memory dictionary.
Designed to be paired with a MemorySink, together as the two components of a MemoryStore.
Parameters: - stix_data (dict OR list OR STIX object) – valid STIX 2.0 content in bundle or list.
- _store (bool) – if the MemorySource is a part of a MemoryStore, in which case “stix_data” is a direct reference to shared memory with DataSink. Not user supplied
- allow_custom (bool) – whether to allow custom objects/properties when importing STIX content from file. Default: True.
- version (str) – If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the “spec_version” property.
-
_data
¶ the in-memory dict that holds STIX objects. If part of a MemoryStore, the dict is shared with a MemorySink
Type: dict
-
all_versions
(stix_id, _composite_filters=None)¶ Retrieve STIX objects from in-memory dict via STIX ID, all versions of it.
Parameters: - stix_id (str) – The STIX ID of the STIX 2 object to retrieve.
- _composite_filters (FilterSet) – collection of filters passed from the parent CompositeDataSource, not user supplied
Returns: (list) – list of STIX objects that have the supplied ID.
-
get
(stix_id, _composite_filters=None)¶ Retrieve STIX object from in-memory dict via STIX ID.
Parameters: - stix_id (str) – The STIX ID of the STIX object to be retrieved.
- _composite_filters (FilterSet) – collection of filters passed from the parent CompositeDataSource, not user supplied
Returns: (STIX object) – STIX object that has the supplied ID.
-
load_from_file
(file_path, version=None, encoding='utf-8')¶ Load STIX data from JSON file.
File format is expected to be a single JSON STIX object or JSON STIX bundle.
Parameters: path (str) – file path to load STIX data from
-
query
(query=None, _composite_filters=None)¶ Search and retrieve STIX objects based on the complete query.
A “complete query” includes the filters from the query, the filters attached to this MemorySource, and any filters passed from a CompositeDataSource (i.e. _composite_filters).
Parameters: - query (list) – list of filters to search on
- _composite_filters (FilterSet) – collection of filters passed from the CompositeDataSource, not user supplied
Returns: (list) – list of STIX objects that match the supplied query.
-
class
MemoryStore
(stix_data=None, allow_custom=True, version=None)¶ Interface to an in-memory dictionary of STIX objects.
MemoryStore is a wrapper around a paired MemorySink and MemorySource.
Note: It doesn’t make sense to create a MemoryStore by passing in existing MemorySource and MemorySink because there could be data concurrency issues. As well, just as easy to create new MemoryStore.
Parameters: - stix_data (list OR dict OR STIX object) – STIX content to be added
- allow_custom (bool) – whether to allow custom STIX content. Only applied when export/input functions called, i.e. load_from_file() and save_to_file(). Defaults to True.
-
_data
¶ the in-memory dict that holds STIX objects
Type: dict
-
source
¶ MemorySource
Type: MemorySource
-
sink
¶ MemorySink
Type: MemorySink
-
load_from_file
(*args, **kwargs)¶ Load STIX data from JSON file.
File format is expected to be a single JSON STIX object or JSON STIX bundle.
Parameters: path (str) – file path to load STIX data from
-
save_to_file
(*args, **kwargs)¶ Write SITX objects from in-memory dictionary to JSON file, as a STIX Bundle. If a directory is given, the Bundle ‘id’ will be used as filename. Otherwise, the provided value will be used.
Parameters: - path (str) – file path to write STIX data to.
- encoding (str) – The file encoding. Default utf-8.