Begins STIX2 Modules

pyproject.toml

@@ -2,9 +2,9 @@
 name = "PyLOOBins"
 version = "1.7.2"
 description = "Python package for managing the LOOBins model and schema."
-authors = ["infosecB <[email protected]>"]
+authors = ["infosecB <[email protected]>", "0xv1n <[email protected]>"]
 readme = "docs/pyloobins/README.md"
-packages = [{include = "pyloobins", from = "src"}]
+packages = [{ include = "pyloobins", from = "src" }]
 include = ["LOOBins/*.yml"]
 homepage = "https://loobins.io/"
 repository = "https://github.com/infosecB/LOOBins"
@@ -17,6 +17,8 @@ pydantic = "^2"
 pyyaml = "^6.0"
 click = "^8.1.3"
 jinja2 = "^3.1.2"
+stix2 = "^3.0.1"
+pydantic-factories = "^1.17.3"
 
 
 [tool.poetry.group.dev.dependencies]
@@ -35,10 +37,7 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.pylint.'MESSAGES CONTROL']
-disable=[
-  'no-name-in-module',
-  'too-few-public-methods'
-]
+disable = ['no-name-in-module', 'too-few-public-methods']
 
 [tool.tox]
 legacy_tox_ini = """

src/pyloobins/models.py

@@ -1,11 +1,14 @@
 """Model that represents a LOOBin and its various components"""
+
 from datetime import date
 from typing import List, Literal, Optional
 
 import yaml
 from jinja2 import Environment, PackageLoader, select_autoescape
 from pydantic import BaseModel, Field, RootModel
 
+from pydantic_factories import ModelFactory
+
 AttackTactics = Literal[
     "Reconnaissance",
     "Resource Development",
@@ -138,4 +141,10 @@ def __repr__(self) -> str:
 class LOOBinsGroup(RootModel[List[str]]):
     """LOOBin list base class"""
 
-    root: List[LOOBin] = Field(title="LOOBins", description="A list of LOOBins")
+    __root__: List[LOOBin] = Field(title="LOOBins", description="A list of LOOBins")
+
+
+class LOOBinsFactory(ModelFactory):
+    """Used to create mock LOOBins for tests"""
+
+    __model__ = LOOBin

src/pyloobins/stix.py

@@ -0,0 +1,44 @@
+from stix2 import Tool, Bundle
+from datetime import datetime, timezone
+from pyloobins.models import LOOBin
+from pyloobins.util import get_loobins
+
+
+def convert_to_stix_tool(loobins: list[LOOBin]) -> list[Tool]:
+    """Takes in a LOOBin and Converts to STIX2 Tool
+    https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_z4voa9ndw8v
+
+    Required fields per STIX2 spec:
+        - type: must be 'tool'
+        - name: str
+
+    Optional fields:
+        - description (str)
+        - tool_types (list of open-vocab -> tool-type-ov)
+        - aliases (list of str)
+        - kill_chain_phases (list of kill-chain-phase)
+    """
+    stix_tools = []
+
+    for loobin in loobins:
+        tool = Tool(
+            name=loobin.name,
+            description=loobin.full_description,
+            created=datetime.now(timezone.utc)
+            .isoformat(timespec="milliseconds")
+            .replace("+00:00", "Z"),
+        )
+        stix_tools.append(tool)
+    return stix_tools
+
+
+def generate_loobin_tool_stix_bundle(stix_tools: list[Tool]) -> Bundle:
+    return Bundle(objects=stix_tools)
+
+
+if __name__ == "__main__":
+    loobins = get_loobins("./")
+    tools = convert_to_stix_tool(loobins)
+    print(tools)
+    bundle = generate_loobin_tool_stix_bundle(tools)
+    print(bundle)

src/pyloobins/util.py

@@ -1,4 +1,5 @@
 """Utility functions that support the CLI and library"""
+
 import pathlib
 from datetime import date
 

tests/test_stix.py

@@ -0,0 +1,17 @@
+from pyloobins.models import LOOBinsFactory
+from pyloobins.stix import convert_to_stix_tool
+
+
+def test_convert_to_stix_tool():
+    loobins = LOOBinsFactory.batch(size=5)
+
+    tools = convert_to_stix_tool(loobins)
+
+    assert len(tools) == len(loobins), "Mismatch in number of tools converted"
+
+    for i, tool in enumerate(tools):
+        assert tool.type == "tool", "Type field should always be 'tool'"
+        assert tool.name == loobins[i].name, f"Tool name mismatch for index {i}"
+        assert (
+            tool.description == loobins[i].full_description
+        ), f"Description mismatch for index {i}"