Creating, handling, and parsing TAXII 1.1 messages.
Note
The examples on this page assume that you have run the equivalent of
import datetime
from dateutil.tz import tzutc
import libtaxii as t
import libtaxii.messages_11 as tm11
A TAXII Status message.
Parameters: |
|
---|
Example:
sm03 = tm11.StatusMessage(
message_id='SM03',
in_response_to=tm11.generate_message_id(),
status_type=tm11.ST_DESTINATION_COLLECTION_ERROR,
status_detail={'ACCEPTABLE_DESTINATION': ['Collection1','Collection2']})
A TAXII Discovery Request message.
Parameters: |
|
---|
Example:
headers={'ext_header1': 'value1', 'ext_header2': 'value2'}
discovery_request = tm11.DiscoveryRequest(
message_id=tm11.generate_message_id(),
extended_headers=headers)
A TAXII Discovery Response message.
Parameters: |
|
---|
The Service Instance component of a TAXII Discovery Response Message.
Parameters: |
|
---|
The message_bindings list must contain at least one value. The supported_query parameter is optional when service_type is SVC_POLL.
Example:
discovery_response = tm11.DiscoveryResponse(
message_id=tm11.generate_message_id(),
in_response_to=discovery_request.message_id)
service_instance = tm11.ServiceInstance(
service_type=tm11.SVC_POLL,
services_version=t.VID_TAXII_SERVICES_11,
protocol_binding=t.VID_TAXII_HTTP_10,
service_address='http://example.com/poll/',
message_bindings=[t.VID_TAXII_XML_11],
available=True,
message='This is a message.',
#supported_query=[tdq1],
)
discovery_response.service_instances.append(service_instance)
# Alternatively, you could define the service instance(s) first and use the
# following:
service_instance_list = [service_instance]
discovery_response = tm11.DiscoveryResponse(
message_id=tm11.generate_message_id(),
in_response_to=discovery_request.message_id,
service_instances=service_instance_list)
A TAXII Collection Information Request message.
Parameters: |
|
---|
Example:
ext_headers = {'name1': 'val1', 'name2': 'val2'}
collection_information_request = tm11.CollectionInformationRequest(
message_id='CIReq01',
extended_headers=ext_headers)
A TAXII Collection Information Response message.
Parameters: |
|
---|
The Collection Information component of a TAXII Collection Information Response Message.
Parameters: |
|
---|
If supported_contents is omitted, then the collection supports all content bindings. The absense of push_methods indicates no push methods. The absense of polling_service_instances indicates no polling services. The absense of subscription_methods indicates no subscription services. The absense of receiving_inbox_services indicates no receiving inbox services.
The Push Method component of a TAXII Collection Information component.
Parameters: |
|
---|
The Polling Service Instance component of a TAXII Collection Information component.
Parameters: |
|
---|
The Subscription Method component of a TAXII Collection Information component.
Parameters: |
|
---|
The Receiving Inbox Service component of a TAXII Collection Information component.
Parameters: |
|
---|
Example:
push_method1 = tm11.PushMethod(
push_protocol=t.VID_TAXII_HTTP_10,
push_message_bindings=[t.VID_TAXII_XML_11])
poll_service1 = tm11.PollingServiceInstance(
poll_protocol=t.VID_TAXII_HTTPS_10,
poll_address='https://example.com/PollService1',
poll_message_bindings=[t.VID_TAXII_XML_11])
poll_service2 = tm11.PollingServiceInstance(
poll_protocol=t.VID_TAXII_HTTPS_10,
poll_address='https://example.com/PollService2',
poll_message_bindings=[t.VID_TAXII_XML_11])
subs_method1 = tm11.SubscriptionMethod(
subscription_protocol=t.VID_TAXII_HTTPS_10,
subscription_address='https://example.com/SubscriptionService',
subscription_message_bindings=[t.VID_TAXII_XML_11])
inbox_service1 = tm11.ReceivingInboxService(
inbox_protocol=t.VID_TAXII_HTTPS_10,
inbox_address='https://example.com/InboxService',
inbox_message_bindings=[t.VID_TAXII_XML_11],
supported_contents=None)
collection1 = tm11.CollectionInformation(
collection_name='collection1',
collection_description='This is a collection',
supported_contents=[tm11.ContentBinding(t.CB_STIX_XML_101)],
available=False,
push_methods=[push_method1],
polling_service_instances=[poll_service1, poll_service2],
subscription_methods=[subs_method1],
collection_volume=4,
collection_type=tm11.CT_DATA_FEED,
receiving_inbox_services=[inbox_service1])
collection_response1 = tm11.CollectionInformationResponse(
message_id='CIR01',
in_response_to='0',
collection_informations=[collection1])
A TAXII Manage Collection Subscription Request message.
Parameters: |
|
---|
Example:
subscription_parameters1 = tm11.SubscriptionParameters()
push_parameters1 = tm11.PushParameters("", "", "")
subs_req1 = tm11.ManageCollectionSubscriptionRequest(
message_id='SubsReq01',
action=tm11.ACT_SUBSCRIBE,
collection_name='collection1',
subscription_parameters=subscription_parameters1,
push_parameters=push_parameters1)
A TAXII Manage Collection Subscription Response message.
Parameters: |
|
---|
The Subscription Instance component of the Manage Collection Subscription Response message.
Parameters: |
|
---|
The Poll Instance component of the Manage Collection Subscription Response message.
Parameters: |
|
---|
Example:
subscription_parameters1 = tm11.SubscriptionParameters()
push_parameters1 = tm11.PushParameters("", "", "")
poll_instance1 = tm11.PollInstance(
poll_protocol=t.VID_TAXII_HTTPS_10,
poll_address='https://example.com/poll1/',
poll_message_bindings=[t.VID_TAXII_XML_11])
subs1 = tm11.SubscriptionInstance(
subscription_id='Subs001',
status=tm11.SS_ACTIVE,
subscription_parameters=subscription_parameters1,
push_parameters=push_parameters1,
poll_instances=[poll_instance1])
subs_resp1 = tm11.ManageCollectionSubscriptionResponse(
message_id='SubsResp01',
in_response_to='xyz',
collection_name='abc123',
message='Hullo!',
subscription_instances=[subs1])
A TAXII Poll Request message.
Parameters: |
|
---|
Exactly one of subscription_id and poll_parameters is Required.
The Poll Parameters component of a TAXII Poll Request message.
Parameters: |
|
---|
If content_bindings in not provided, this indicates that all bindings are accepted as a response.
Example:
delivery_parameters1 = tm11.DeliveryParameters(
inbox_protocol=t.VID_TAXII_HTTPS_10,
inbox_address='https://example.com/inboxAddress/',
delivery_message_binding=t.VID_TAXII_XML_11)
poll_params1 = tm11.PollParameters(
allow_asynch=False,
response_type=tm11.RT_COUNT_ONLY,
content_bindings=[tm11.ContentBinding(binding_id=t.CB_STIX_XML_11)],
#query=query1,
delivery_parameters=delivery_parameters1)
poll_req3 = tm11.PollRequest(
message_id='PollReq03',
collection_name='collection100',
exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
poll_parameters=poll_params1)
A TAXII Poll Response message.
Parameters: |
|
---|
Example:
cb1 = tm11.ContentBlock(t.CB_STIX_XML_11, "")
cb2 = tm11.ContentBlock(t.CB_STIX_XML_11, "")
count = tm11.RecordCount(record_count=22, partial_count=False)
poll_resp1 = tm11.PollResponse(
message_id='PollResp1',
in_response_to='tmp',
collection_name='blah',
exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
subscription_id='24',
message='This is a test message',
content_blocks=[cb1, cb2],
more=True,
result_id='123',
result_part_number=1,
record_count=count)
A TAXII Inbox message.
Parameters: |
|
---|
The Subscription Information component of a TAXII Inbox message.
Parameters: |
|
---|
Example:
cb1 = tm11.ContentBlock(t.CB_STIX_XML_11, "")
cb2 = tm11.ContentBlock(t.CB_STIX_XML_11, "")
subs_info1 = tm11.SubscriptionInformation(
collection_name='SomeCollectionName',
subscription_id='SubsId021',
exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()))
inbox1 = tm11.InboxMessage(
message_id='Inbox1',
result_id='123',
destination_collection_names=['collection1','collection2'],
message='Hello!',
subscription_information=subs_info1,
record_count=tm11.RecordCount(22, partial_count=True),
content_blocks=[cb1, cb2])
A TAXII Poll Fulfillment Request message.
Parameters: |
|
---|
Example:
pf1 = tm11.PollFulfillmentRequest(
message_id='pf1',
collection_name='1-800-collection',
result_id='123',
result_part_number=1)
Encapsulate properties common to all TAXII Messages (such as headers).
This class is extended by each Message Type (e.g., DiscoveryRequest), with each subclass containing subclass-specific information
TAXII Content Binding component
Parameters: |
|
---|
A TAXII Content Block.
Parameters: |
|
---|
Example:
cb001 = tm11.ContentBlock(
content_binding=tm11.ContentBinding(t.CB_STIX_XML_11),
content='<stix:STIX_Package xmlns:stix="http://stix.mitre.org/stix-1"/>',
timestamp_label=datetime.datetime.now(tzutc()),
message='Hullo!',
padding='The quick brown fox jumped over the lazy dogs.')
Set up Delivery Parameters.
Parameters: |
|
---|
Set up Push Parameters.
Parameters: |
|
---|
Information summarizing the number of records.
Parameters: |
|
---|
TAXII Subscription Parameters.
Parameters: |
|
---|
Generate a TAXII Message ID.
Parameters: | maxlen (int) – maximum length of the ID, in characters |
---|
Example
msg_id = tm11.generate_message_id()
message = tm11.DiscoveryRequest(msg_id)
# Or...
message = tm11.DiscoveryRequest(tm11.generate_message_id())
Note that this function has been deprecated. Please see libtaxii.validators.SchemaValidator.
Validate XML with the TAXII XML Schema 1.1.
Parameters: | xml_string (str) – The XML to validate. |
---|
Example
is_valid = tm11.validate_xml(message.to_xml())
Create a TAXIIMessage object from an XML string.
This function automatically detects which type of Message should be created based on the XML.
Parameters: | xml_string (str) – The XML to parse into a TAXII message. |
---|
Example
message_xml = message.to_xml()
new_message = tm11.get_message_from_xml(message_xml)
Create a TAXIIMessage object from a dictonary.
This function automatically detects which type of Message should be created based on the ‘message_type’ key in the dictionary.
Parameters: | d (dict) – The dictionary to build the TAXII message from. |
---|
Example
message_dict = message.to_dict()
new_message = tm11.get_message_from_dict(message_dict)
Create a TAXIIMessage object from a JSON string.
This function automatically detects which type of Message should be created based on the JSON.
Parameters: | json_string (str) – The JSON to parse into a TAXII message. |
---|