-_find_search_optimizations..s$9F#(--c38# UHn[U5v M g7frSrTrUs rrXrYs- -;c S ! !^rZc3^># UH"n[U5TR;dMUv M$ g7frS)rr-)rVrW opt_typess rrXrYs,+ )C$ (8(88 C>s- -) rEr?oprLrJrGrrr0r%r-rH)filters allowed_types allowed_idsprohibited_typesprohibited_idsfilter_opt_idsr]s @r_find_search_optimizationsrfs"#'&MuUN   v %zz[( -m]] K t# $$W]]3$   %zzS ,KG -!$W]]3! t#""7==1t#+KG -!$9@$! )4 8Ik2Ggmm+    .,,- -4^^-   **+ ">>+  g rc/nUR[R:XaURHqnXS-nU(aF[R "[R RX55nU"UR5nOSnU(aURU5 MqMs U$[R"U5Hn U(a)[R RU 5upX:waM2OU n XR;aMFU(aF[R "[R RX 55nU"UR5nOSnU(aURU 5 MM U$![a+n U R[R:waeSn A GMsSn A ff=f![a+n U R[R:waeSn A GMSn A ff=f)a Search a directory (non-recursively), and find entries which match the given criteria. Args: parent_dir: The directory to search auth_set: an AuthSet instance, which represents a black/whitelist filter on filenames st_mode_test: A callable allowing filtering based on the type of directory entry. E.g. just get directories, or just get files. It will be passed the st_mode field of a stat() structure and should return True to include the file, or False to exclude it. Easy thing to do is pass one of the stat module functions, e.g. stat.S_ISREG. If None, don't filter based on entry type. ext: Determines how names from auth_set match up to directory entries, and allows filtering by extension. The extension is added to auth_set values to obtain directory entries; it is removed from directory entries to obtain auth_set values. In this way, auth_set may be treated as having only "basenames" of the entries. Only entries having the given extension will be included in the results. If not empty, the extension MUST include a leading ".". The default is the empty string, which will result in direct comparisons, and no extension-based filtering. Returns: (list): A list of directory entries matching the criteria. These will not have any path info included; they will just be bare names. Raises: OSError: If there are errors accessing directory contents or stat()'ing files TN)r0rr%r-osstatpathjoinst_modeappendOSErrorerrnoENOENTlistdirsplitext) parent_dirauth_set st_mode_testextresultsrJfilenames type_passeentry auth_namethis_exts r_get_matching_dir_entriesrswDGW]]*__E{H  Z BCA ,QYY 7I $INN8,%R N3ZZ +E&(gg&6&6u&=# ?#" OO+  Z ?@A ,QYY 7I $INN5)%,2 N= 77ell*+ 2 77ell*+ s1A'E0A'F(0 F%:F  F%( G2GGcL[R"USUS9n[R"U5nSSS5 [WX#5nUSS:XaUSSn[[U/U5S5nU$!,(df  ND=f![a [ SR U55ef=f) aY Read a STIX object from the given file, and check it against the given filters. Args: query: Iterable of filters filepath (str): Path to file to read allow_custom (bool): Whether to allow custom properties as well unknown custom objects. version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. encoding (str): The encoding to use when reading a file from the filesystem. Returns: The (parsed) STIX object, if the object passes the filters. If not, None is returned. Raises: TypeError: If the file had invalid JSON IOError: If there are problems opening/reading the file stix2.exceptions.STIXError: If there were problems creating a STIX object from the JSON r)encodingNzWSTIX JSON object at '{0}' could either not be parsed to JSON or was not valid STIX JSONrNbundleobjectsr) ioopenjsonload ValueError TypeErrorr5r nextr ) queryfilepath allow_customversionrf stix_jsonstix_objresults r_check_object_from_filers6 WWXsX 6! ! I7Y 6H8#I&q)&z594 @F M!7 6   1171A   s'A>A-A>- A;7A>;A>>%B#c[R"S[R"U5-S-[R5n[R "U5Hxn[R "[RRX55n[ R"UR5(dM]URU5(dMuSn U$ SnU$)a Try to detect whether the given directory is for a versioned type of STIX object. This is done by looking for a directory whose name is a STIX ID of the appropriate type. If found, treat this type as versioned. This doesn't work when a versioned type directory is empty (it will be mis-classified as unversioned), but this detection is only necessary when reading/querying data. If a directory is empty, you'll get no results either way. Args: type_path: A path to a directory containing one type of STIX object. type_name: The STIX type name. Returns: True if the directory looks like it contains versioned objects; False if not. Raises: OSError: If there are errors accessing directory contents or stat()'ing files ^z?--[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$TF) rcompileescapeIrhrqrirjrkS_ISDIRrlmatch) type_path type_nameid_regexr|ry is_versioneds r_is_versioned_type_dirrMs,zz ryy##    HI& GGBGGLL2 3 << " "x~~e'<'<L  '  rc /n[X[R5nUHn[RR X5n [U [ [RS5n U HJn [RR X5n [X X4U5n U (aURU 5 MJML M [XX#XE5nURU5 U$![a*nUR[R:waeSnAMSnAff=f)a Searches the given directory, which contains data for STIX objects of a particular versioned type, and return any which match the query. Args: query: The query to match against type_path: The directory with type-specific STIX object files auth_ids: Search optimization based on object ID allow_custom (bool): Whether to allow custom properties as well unknown custom objects. version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. encoding (str): The encoding to use when reading a file from the filesystem. Returns: A list of all matching objects Raises: stix2.exceptions.STIXError: If any objects had invalid content TypeError: If any objects had invalid content IOError: If there were any problems opening/reading files OSError: If there were any problems opening/reading files .jsonN)rrirrhrjrk _AUTHSET_ANYS_ISREGrrmIOErrorrorp_search_unversionedextend)rrauth_idsrrrrwid_dirsid_dirid_path version_files version_file version_pathrr{backcompat_resultss r_search_versionedrus6G' G'',,y1 2 \ LL' *L77<<>L 2  NN8,*8- (' NN%& N 77ell*+ s%C D DD cN/n[X[RS5nUHJn[RR X5n [ X UXE5n U (aURU 5 MJML U$![a*n U R[R:waeSn A MSn A ff=f)a Searches the given directory, which contains unversioned data, and return any objects which match the query. Args: query: The query to match against type_path: The directory with STIX files of unversioned type auth_ids: Search optimization based on object ID allow_custom (bool): Whether to allow custom properties as well unknown custom objects. version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. encoding (str): The encoding to use when reading a file from the filesystem. Returns: A list of all matching objects Raises: stix2.exceptions.STIXError: If any objects had invalid content TypeError: If any objects had invalid content IOError: If there were any problems opening/reading files OSError: If there were any problems opening/reading files rN) rrirrhrjrkrrmrrorp) rrrrrrrwid_filesid_filerrr{s rrrs:G(T\\H'',,y2 . Hx( N  ww%,,&' s%A00 B$:BB$c0^\rSrSrSrSU4SjjrSrU=r$)FileSystemStoreia+Interface to a file directory of STIX objects. FileSystemStore is a wrapper around a paired FileSystemSink and FileSystemSource. Args: stix_dir (str): path to directory of STIX objects allow_custom (bool): whether to allow custom STIX content to be pushed/retrieved. Defaults to True for FileSystemSource side (retrieving data) and False for FileSystemSink side(pushing data). However, when parameter is supplied, it will be applied to both FileSystemSource and FileSystemSink. bundlify (bool): whether to wrap objects in bundles when saving them. Default: False. encoding (str): The encoding to use when reading a file from the filesystem. Attributes: source (FileSystemSource): FileSystemSource sink (FileSystemSink): FileSystemSink c `>UcSnSnOU=pe[[U] [XUS9[ XUS9S9 g)NTF)stix_dirrr)rrbundlify)sourcesink)superrr)FileSystemSourceFileSystemSink)r&rrrrallow_custom_sourceallow_custom_sink __class__s rr)FileSystemStore.__init__sH  "&  % 6B B  ot-#Xbjk\de . rrA)NFutf-8)r:r;r<r=r>r)r@ __classcell__rs@rrrs,   rrcT^\rSrSrSrSU4Sjjr\S5rS SjrS Sjr Sr U=r $) riaInterface for adding/pushing STIX objects to file directory of STIX objects. Can be paired with a FileSystemSource, together as the two components of a FileSystemStore. Args: stix_dir (str): path to directory of STIX objects. allow_custom (bool): Whether to allow custom STIX content to be added to the FileSystemSource. Default: False bundlify (bool): Whether to wrap objects in bundles when saving them. Default: False. c>[[U] 5 [RR U5UlX lX0l[RRUR 5(d [S5eg)Nz+directory path for STIX data does not exist) rrr)rhrjabspath _stix_dirrrexistsr)r&rrrrs rr)FileSystemSink.__init__ sW nd,.2( ww~~dnn--JK K.rcUR$rSrr,s rrFileSystemSink.stix_dir) ~~rc .[RRURUS5nSU;a1[ US5n[RRX1S5nOUSnUn[RRXTS-5n[RR U5(d[R "U5 UR(aCSU;a[R"XRS9nO[R"XRS9n[RRU5(a[SRU55e[R "USUS 9n[#XS US S 9 S S S 5 g !,(df  g =f)zJWrite the given STIX object to a file in the STIX file directory. rNmodifiedrQr spec_version)rz&Attempted to overwrite file (!) at: {}w)moderTF)prettyr ensure_asciiN)rhrjrkrrrmakedirsrrBundlerrisfilerr5rrr)r&rrtype_dirrxobj_dir file_pathrs r_check_path_and_write$FileSystemSink._check_path_and_write-s%77<<0@A  !*8J+?@Hggll8d^>) $ $!"J"Q"QR["\] ] WWYS8 < THSX Y= < r)r?rrrGr@rrs@rrrs3 LZB,,rrc^^\rSrSrSrS U4Sjjr\S5rS SjrS Sjr S Sjr Sr U=r $) ri}aInterface for searching/retrieving STIX objects from a STIX object file directory. Can be paired with a FileSystemSink, together as the two components of a FileSystemStore. Args: stix_dir (str): path to directory of STIX objects allow_custom (bool): Whether to allow custom STIX content to be added to the FileSystemSink. Default: True encoding (str): The encoding to use when reading a file from the filesystem. c>[[U] 5 [RR U5UlX lX0l[RRUR 5(d[SUR -5eg)Nz/directory path for STIX data does not exist: %s) rrr)rhrjrrrrrr)r&rrrrs rr)FileSystemSource.__init__sd .02( ww~~dnn--NQUQ_Q__` `.rcUR$rSrr,s rrFileSystemSource.stix_dirrrcURXUS9nU(a'SUS;nU(a[USS9SnU$USnU$SnU$)a{Retrieve STIX object from file directory via STIX ID. Args: stix_id (str): The STIX ID of the STIX object to be retrieved. _composite_filters (FilterSet): collection of filters passed from the parent CompositeDataSource, not user supplied version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. Returns: (STIX object): STIX object that has the supplied STIX ID. The STIX object is loaded from its json file, parsed into a python STIX object and then returned r_composite_filtersrrc US$)NrrA)ks r&FileSystemSource.get..s!J-r)keyN) all_versionssorted)r&stix_idrrall_datarrs rrFileSystemSource.getsg"$$WRd$e &!4L!(0GHL  $A;Hrc>[SSU5/nURXBUS9$)aRetrieve STIX object from file directory via STIX ID, all versions. Note: Since FileSystem sources/sinks don't handle multiple versions of a STIX object, this operation is unnecessary. Pass call to get(). Args: stix_id (str): The STIX ID of the STIX objects to be retrieved. _composite_filters (FilterSet): collection of filters passed from the parent CompositeDataSource, not user supplied version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. Returns: (list): of STIX objects that has the supplied STIX ID. The STIX objects are loaded from their json files, parsed into a python STIX objects and then returned rQrOr)r r)r&rrrrs rrFileSystemSource.all_versionss)(c7+,zz%EWzXXrc F/n[U5nUR(aURUR5 U(aURU5 [U5upV[ UR U[ R5nUHn[RRUR U5n [X5n U (a$[XUURUUR5n O#[XUURUUR5n UR!U 5 M U$)a(Search and retrieve STIX objects based on the complete query. A "complete query" includes the filters from the query, the filters attached to this FileSystemSource, and any filters passed from a CompositeDataSource (i.e. _composite_filters). Args: query (list): list of filters to search on _composite_filters (FilterSet): collection of filters passed from the CompositeDataSource, not user supplied version (str): If present, it forces the parser to use the version provided. Otherwise, the library will make the best effort based on checking the "spec_version" property. Returns: (list): list of STIX objects that matches the supplied query. The STIX objects are loaded from their json files, parsed into a python STIX objects and then returned. )r r_rGrfrrrirrhrjrkrrrrrr) r&rrrr auth_typesr type_dirsrrtype_is_versioned type_resultss rrFileSystemSource.querys*%  << IIdll #  II( )9%@ - NNJ LL "H T^^X>I 6y K  0h%%wMM  3h%%wMM  OOL )""r)rrr)Trr)NNN) r:r;r<r=r>r)r?rrrrr@rrs@rrr}s8 aBY.44rr)Nr),r>rorrrhrristix2rr stix2.baserstix2.datastorerrrr stix2.datastore.filtersr r r stix2.parsingr stix2.serializationr stix2.utilsrrrrobjectrrErrLrfrrrrrrrrrArrr s)  LK,NN"9 f9 ztSU#  FCLM`,^%PAH1h! n! HiXiXHzHr