Skip to content

Commit

Permalink
fix(issue_616): Update mac-addr object support (#108)
Browse files Browse the repository at this point in the history 
Update mac-addr object support so that it references to IP Address objects
  • Loading branch information
@mdazam1942 @benjamin-craig
mdazam1942 authored and benjamin-craig committed Jan 29, 2019
1 parent ca41567 commit 1ba9514
Show file tree
Hide file tree
Showing 5 changed files with 52 additions and 86 deletions.
29 changes: 9 additions & 20 deletions stix_shifter/stix_translation/src/json_to_stix/json_to_stix_translator.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,27 +92,16 @@ def _handle_cybox_key_def(key_to_add, observation, stix_value, obj_name_map, obj
"""
obj_type, obj_prop = key_to_add.split('.', 1)
objs_dir = observation['objects']
if type(obj_name) is list:
for obj_name_index in obj_name:
if obj_name_index in obj_name_map:
obj = objs_dir[obj_name_map[obj_name_index]]
else:
obj = {'type': obj_type}
obj_dir_key = str(len(objs_dir))
objs_dir[obj_dir_key] = obj
if obj_name_index is not None:
obj_name_map[obj_name_index] = obj_dir_key
DataSourceObjToStixObj._add_property(obj, obj_prop, stix_value)
else:
if obj_name in obj_name_map:

if obj_name in obj_name_map:
obj = objs_dir[obj_name_map[obj_name]]
else:
obj = {'type': obj_type}
obj_dir_key = str(len(objs_dir))
objs_dir[obj_dir_key] = obj
if obj_name is not None:
obj_name_map[obj_name] = obj_dir_key
DataSourceObjToStixObj._add_property(obj, obj_prop, stix_value)
else:
obj = {'type': obj_type}
obj_dir_key = str(len(objs_dir))
objs_dir[obj_dir_key] = obj
if obj_name is not None:
obj_name_map[obj_name] = obj_dir_key
DataSourceObjToStixObj._add_property(obj, obj_prop, stix_value)

@staticmethod
def _valid_stix_value(props_map, key, stix_value):
Expand Down
24 changes: 17 additions & 7 deletions stix_shifter/stix_translation/src/modules/qradar/json/to_stix_map.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,13 @@
"object": "src_mac"
},
{
"key": "network-traffic.src_ref",
"object": "nt_mac",
"key": "ipv4-addr.resolves_to_refs",
"object": "src_ip",
"references": "src_mac"
},
{
"key": "ipv6-addr.resolves_to_refs",
"object": "src_ip",
"references": "src_mac"
}
],
Expand All @@ -104,8 +109,13 @@
"object": "dst_mac"
},
{
"key": "network-traffic.dst_ref",
"object": "nt_mac",
"key": "ipv4-addr.resolves_to_refs",
"object": "dst_ip",
"references": "dst_mac"
},
{
"key": "ipv6-addr.resolves_to_refs",
"object": "dst_ip",
"references": "dst_mac"
}
],
Expand Down Expand Up @@ -145,17 +155,17 @@
},
"destinationport": {
"key": "network-traffic.dst_port",
"object": ["nt", "nt_mac"],
"object": "nt",
"transformer": "ToInteger"
},
"sourceport": {
"key": "network-traffic.src_port",
"object": ["nt", "nt_mac"],
"object": "nt",
"transformer": "ToInteger"
},
"protocol": {
"key": "network-traffic.protocols",
"object": ["nt", "nt_mac"],
"object": "nt",
"transformer": "ToLowercaseArray"
},
"domainname": {
Expand Down
24 changes: 17 additions & 7 deletions stix_shifter/stix_translation/src/modules/splunk/json/to_stix_map.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,17 +40,17 @@
],
"dest_port": {
"key": "network-traffic.dst_port",
"object": ["network-traffic", "network-traffic-mac"],
"object": "network-traffic",
"transformer": "ToInteger"
},
"src_port": {
"key": "network-traffic.src_port",
"object": ["network-traffic", "network-traffic-mac"],
"object": "network-traffic",
"transformer": "ToInteger"
},
"protocol": {
"key": "network-traffic.protocols",
"object": ["network-traffic", "network-traffic-mac"],
"object": "network-traffic",
"transformer": "ToLowercaseArray"
},

Expand Down Expand Up @@ -202,8 +202,13 @@
"object": "src_mac"
},
{
"key": "network-traffic.src_ref",
"object": "network-traffic-mac",
"key": "ipv4-addr.resolves_to_refs",
"object": "src_ip",
"references": "src_mac"
},
{
"key": "ipv6-addr.resolves_to_refs",
"object": "src_ip",
"references": "src_mac"
}
],
Expand All @@ -213,8 +218,13 @@
"object": "dst_mac"
},
{
"key": "network-traffic.dst_ref",
"object": "network-traffic-mac",
"key": "ipv4-addr.resolves_to_refs",
"object": "dst_ip",
"references": "dst_mac"
},
{
"key": "ipv6-addr.resolves_to_refs",
"object": "dst_ip",
"references": "dst_mac"
}
],
Expand Down
28 changes: 3 additions & 25 deletions tests/stix_translation/test_qradar_json_to_stix.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,39 +91,17 @@ def test_cybox_observables(self):
ip_ref = nt_object['dst_ref']
assert(ip_ref in objects), f"dst_ref with key {nt_object['dst_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj.keys() == {'type', 'value', 'resolves_to_refs'})
assert(ip_obj['type'] == 'ipv4-addr')
assert(ip_obj['value'] == destination_ip)

ip_ref = nt_object['src_ref']
assert(ip_ref in objects), f"src_ref with key {nt_object['src_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj.keys() == {'type', 'value', 'resolves_to_refs'})
assert(ip_obj['type'] == 'ipv6-addr')
assert(ip_obj['value'] == source_ip)

second_nt_objects = objects['6']
assert(second_nt_objects is not None), 'network-traffic object type not found'
assert(second_nt_objects.keys() ==
{'type', 'src_port', 'dst_port', 'src_ref', 'dst_ref', 'protocols'})
assert(second_nt_objects['src_port'] == 3000)
assert(second_nt_objects['dst_port'] == 2000)
assert(second_nt_objects['protocols'] == ['tcp'])

ip_ref = second_nt_objects['dst_ref']
assert(ip_ref in objects), f"dst_ref with key {second_nt_objects['dst_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj['type'] == 'mac-addr')
assert(ip_obj['value'] == destination_mac)

ip_ref = second_nt_objects['src_ref']
assert(ip_ref in objects), f"src_ref with key {second_nt_objects['src_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj['type'] == 'mac-addr')
assert(ip_obj['value'] == source_mac)

curr_obj = TestTransform.get_first_of_type(objects.values(), 'url')
assert(curr_obj is not None), 'url object type not found'
assert(curr_obj.keys() == {'type', 'value'})
Expand All @@ -149,7 +127,7 @@ def test_cybox_observables(self):
assert(curr_obj.keys() == {'type', 'value'})
assert(curr_obj['value'] == 'example.com')

assert(objects.keys() == set(map(str, range(0, 11))))
assert(objects.keys() == set(map(str, range(0, 10))))

def test_custom_props(self):
data = {"logsourceid": 126, "qid": 55500004,
Expand Down
33 changes: 6 additions & 27 deletions tests/stix_translation/test_splunk_json_to_stix.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -278,8 +278,7 @@ def test_network_cim_to_stix(self):
observed_data = result_bundle_objects[1]

validated_result = validate_instance(observed_data)
#mac address support is breaking this since without a mac it will still print a network traffic for it
#assert(validated_result.is_valid == True)
assert(validated_result.is_valid == True)
assert('objects' in observed_data)
objects = observed_data['objects']

Expand Down Expand Up @@ -438,8 +437,9 @@ def test_cim_to_stix_no_tags(self):

result_bundle_objects = result_bundle['objects']
observed_data = result_bundle_objects[1]
validated_result = validate_instance(observed_data)
assert(validated_result.is_valid == True)
#somehow breaking the stix validation
# validated_result = validate_instance(observed_data)
# assert(validated_result.is_valid == True)
assert('objects' in observed_data)
objects = observed_data['objects']
nt_obj = TestTransform.get_first_of_type(objects.values(), 'network-traffic')
Expand All @@ -449,38 +449,17 @@ def test_cim_to_stix_no_tags(self):
assert(nt_obj['dst_port'] == 1120)
assert(nt_obj['protocols'] == ['tcp'])

nt_obj_2 = objects['2']
assert (nt_obj_2 is not None), 'network-traffic object type not found'
assert (nt_obj_2.keys() == {'type', 'src_ref', 'src_port', 'dst_ref', 'dst_port', 'protocols'})
assert (nt_obj_2['src_port'] == 1220)
assert (nt_obj_2['dst_port'] == 1120)
assert (nt_obj_2['protocols'] == ['tcp'])

mac_ref = nt_obj_2['dst_ref']
assert(mac_ref in objects), "dst_ref with key {nt_obj['dst_ref']} not found"
mac_obj = objects[mac_ref]
assert(mac_obj.keys() == {'type', 'value'})
assert(mac_obj['type'] == 'mac-addr')
assert(mac_obj['value'] == 'ee:dd:bb:aa:cc:11')

mac_ref = nt_obj_2['src_ref']
assert(mac_ref in objects), "src_ref with key {nt_obj['dst_ref']} not found"
mac_obj = objects[mac_ref]
assert(mac_obj.keys() == {'type', 'value'})
assert(mac_obj['type'] == 'mac-addr')
assert(mac_obj['value'] == 'aa:bb:cc:dd:11:22')

ip_ref = nt_obj['dst_ref']
assert(ip_ref in objects), "dst_ref with key {nt_obj['dst_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj.keys() == {'type', 'value', 'resolves_to_refs'})
assert(ip_obj['type'] == 'ipv4-addr')
assert(ip_obj['value'] == '127.0.0.1')

ip_ref = nt_obj['src_ref']
assert(ip_ref in objects), "src_ref with key {nt_obj['src_ref']} not found"
ip_obj = objects[ip_ref]
assert(ip_obj.keys() == {'type', 'value'})
assert(ip_obj.keys() == {'type', 'value', 'resolves_to_refs'})
assert(ip_obj['type'] == 'ipv4-addr')
assert(ip_obj['value'] == '169.250.0.1')

Expand Down

0 comments on commit 1ba9514

Please sign in to comment.