development/languages/python

ioc_writer - API providing a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise

Website: http://www.github.com/mandiant/ioc_writer/
License: Apache
Description:
ioc\_writer
===========

The source code in this package is made available under the terms of the
Apache License , Version 2.0. See the "LICENSE " file for more
information.

Status
------

-  |Build Status|
-  |Coverage Status|

Author
------

William Gibb william.gibb at fireeye dot com

Purpose
-------

Provide a python library that allows for basic creation and editing of
OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete)
for various items:

+-----------------------+----------+--------+----------+----------+
| item                  | Create   | Read   | Update   | Delete   |
+=======================+==========+========+==========+==========+
| IOC name              | Yes      | No     | Yes      | Yes      |
+-----------------------+----------+--------+----------+----------+
| IOC description       | Yes      | No     | Yes      | Yes      |
+-----------------------+----------+--------+----------+----------+
| created date          | Yes      | No     | Yes      | N/A      |
+-----------------------+----------+--------+----------+----------+
| last modified date    | Yes      | No     | Yes      | N/A      |
+-----------------------+----------+--------+----------+----------+
| published date        | Yes      | No     | Yes      | N/A      |
+-----------------------+----------+--------+----------+----------+
| link metadata         | Yes      | No     | Yes      | Yes      |
+-----------------------+----------+--------+----------+----------+
| IndicatorItem nodes   | Yes      | No     | NotYet   | Yes      |
+-----------------------+----------+--------+----------+----------+
| Indicator nodes       | Yes      | No     | NotYet   | Yes      |
+-----------------------+----------+--------+----------+----------+
| Parameters            | Yes      | No     | Yes      | Yes      |
+-----------------------+----------+--------+----------+----------+

Items do not have built in Read operations, since all items can be
accesed with built in ElementTree syntax or the use of XPATH to select
portions of the IOC.

No decision has been made about whether or not to support changing of
existing Indicator/IndicatorItem nodes.

See the Docs located at https://pythonhosted.org/ioc\_writer/ and the
examples directory for examples of working with the library. The user
code should avoid having to call functionality in ioc\_writer.ioc\_et.

Requirements
------------

The python "lxml" library must be installed. This can be obtained from
https://pypi.python.org/pypi/lxml

Installation
------------

See the file named "INSTALL" for instructions on installing this library
locally.

Examples
--------

Example code lives in the examples folder of the repository.

1. examples/11\_to\_10\_downgrade Script to downgrade OpenIOC 1.1 to
   OpenIOC 1.1.
2. examples/openioc\_to\_yara Scripts that support encapsulating YARA
   signatures in OpenIOC 1.1 format.
3. examples/simple\_ioc\_writer Script that consumes a csv of data to
   build an IOC. this csv contains the content, context, et cetera. An
   example CSV is provided.

Bug reports / questions / feedback / feature requests
=====================================================

william.gibb at fireeye dot com

.. |Build Status| image:: https://travis-ci.org/mandiant/ioc_writer.svg?branch=master
   :target: https://travis-ci.org/mandiant/ioc_writer
.. |Coverage Status| image:: https://coveralls.io/repos/github/mandiant/ioc_writer/badge.svg?branch=master
   :target: https://coveralls.io/github/mandiant/ioc_writer?branch=master

Packages

ioc_writer-0.3.3-1.el7.src [34 KiB] Changelog by Lawrence R. Rogers (2019-11-19):
* Release 0.3.3-1
	Version 0.3.3 - Renamed to Python2

Listing created by Repoview-0.6.6-4.el7