StixCreator
Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.
python · Common Scripts
Details
| ID | StixCreator |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/py3-tools:1.0.0.11597437 |
README
Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | - |
Inputs
| Argument Name | Description |
|---|---|
| indicators | A JSON object of all indicators and their fields, indicator index mapped to XSOAR common indicator fields. Indicator keys that don’t match the XSOAR common indicator names are also supported, if their key contains a common indicator name (e.g. “special-ip” will be mapped to ip), or their value matches the expected indicator value (e.g. 8.8.8.8 for ip). |
| doubleBackslash | Adds a second backslash to all existing backslashes in the value field. |
Outputs
| Path | Description | Type |
|---|---|---|
| StixExportedIndicators.created | The date/time that the indicator was created. | date |
| StixExportedIndicators.firstSeen | The date/time that the indicator was first seen. | date |
| StixExportedIndicators.source | The source system for this indicator. | string |
| StixExportedIndicators.type | The STIX type (always exported as “indicator”). | string |
| StixExportedIndicators.pattern | The type and value of indicators. For example, “URL”, “IPv4”, “domain”, “email”, and so on. | string |
| StixExportedIndicators.score | The STIX impact score. Can be, “High”, “Medium”, “None”, or “Not Specified”. | string |
| StixExportedIndicators.modified | The date/time that the indicator was last seen. | date |
commonfields: id: StixCreator version: -1 name: StixCreator script: '' type: python tags: [] comment: Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format. enabled: true args: - name: indicators required: true description: A JSON object of all indicators and their fields, indicator index mapped to XSOAR common indicator fields. Indicator keys that don't match the XSOAR common indicator names are also supported, if their key contains a common indicator name (e.g. "special-ip" will be mapped to ip), or their value matches the expected indicator value (e.g. 8.8.8.8 for ip). - name: doubleBackslash default: true description: Adds a second backslash to all existing backslashes in the value field. defaultValue: "true" outputs: - contextPath: StixExportedIndicators.created description: The date/time that the indicator was created. type: date - contextPath: StixExportedIndicators.firstSeen description: The date/time that the indicator was first seen. type: date - contextPath: StixExportedIndicators.source description: The source system for this indicator. type: string - contextPath: StixExportedIndicators.type description: The STIX type (always exported as "indicator"). type: string - contextPath: StixExportedIndicators.pattern description: ' The type and value of indicators, for example: URL, IPv4, domain,email, and so on. ' type: string - contextPath: StixExportedIndicators.score description: The STIX impact score ("High", "Medium", "None", or "Not Specified"). type: string - contextPath: StixExportedIndicators.modified description: The date/time that the indicator was last seen. type: date scripttarget: 0 dockerimage: demisto/py3-tools:1.0.0.11597437 subtype: python3 runas: DBotWeakRole tests: - StixCreator-Test fromversion: 5.0.0