libtaxii.messages_10 Module

Version: 1.1.111


Creating, handling, and parsing TAXII 1.0 messages.

Note

The examples on this page assume that you have run the equivalent of

import datetime
from dateutil.tz import tzutc
import libtaxii as t
import libtaxii.messages_10 as tm10
from libtaxii.constants import *

Status Message

class libtaxii.messages_10.StatusMessage(message_id, in_response_to, extended_headers=None, status_type=None, status_detail=None, message=None)[source]

A TAXII Status message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • status_type (str) – One of the defined Status Types or a third-party- defined Status Type. Required
  • status_detail (str) – A field for additional information about this status in a machine-readable format. Optional or Prohibited depending on status_type. See TAXII Specification for details.
  • message (str) – Additional information for the status. There is no expectation that this field be interpretable by a machine; it is instead targeted to a human operator. Optional

Example:

status_message1 = tm10.StatusMessage(
        message_id=tm10.generate_message_id(),
        in_response_to="12345",
        status_type=ST_SUCCESS,
        status_detail='Machine-processable info here!',
        message='This is a message.')

Discovery Request

class libtaxii.messages_10.DiscoveryRequest(message_id, in_response_to=None, extended_headers=None)[source]

A TAXII Discovery Request message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional

Example:

ext_headers = {'name1': 'val1', 'name2': 'val2'}
discovery_request = tm10.DiscoveryRequest(
        message_id=tm10.generate_message_id(),
        extended_headers=ext_headers)

Discovery Response

class libtaxii.messages_10.DiscoveryResponse(message_id, in_response_to, extended_headers=None, service_instances=None)[source]

A TAXII Discovery Response message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • in_response_to (str) – Contains the Message ID of the message to which this is a response. Optional
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • service_instances (list of ServiceInstance) – a list of service instances that this response contains. Optional
class libtaxii.messages_10.ServiceInstance(service_type, services_version, protocol_binding, service_address, message_bindings, inbox_service_accepted_content=None, available=None, message=None)[source]

The Service Instance component of a TAXII Discovery Response Message.

Parameters:
  • service_type (string) – identifies the Service Type of this Service Instance. Required
  • services_version (string) – identifies the TAXII Services Specification to which this Service conforms. Required
  • protocol_binding (string) – identifies the protocol binding supported by this Service. Required
  • service_address (string) – identifies the network address of the TAXII Daemon that hosts this Service. Required
  • message_bindings (list of strings) – identifies the message bindings supported by this Service instance. Required
  • inbox_service_accepted_content (list of strings) – identifies content bindings that this Inbox Service is willing to accept. Optional
  • available (boolean) – indicates whether the identity of the requester (authenticated or otherwise) is allowed to access this TAXII Service. Optional
  • message (string) – contains a message regarding this Service instance. Optional

The message_bindings list must contain at least one value.

Example:

discovery_response = tm10.DiscoveryResponse(
        message_id=tm10.generate_message_id(),
        in_response_to=discovery_request.message_id)

service_instance = tm10.ServiceInstance(
        service_type=SVC_INBOX,
        services_version=VID_TAXII_SERVICES_10,
        protocol_binding=VID_TAXII_HTTPS_10,
        service_address='https://example.com/inbox/',
        message_bindings=[VID_TAXII_XML_10],
        inbox_service_accepted_content=[CB_STIX_XML_10],
        available=True,
        message='This is a sample inbox service instance')

discovery_response.service_instances.append(service_instance)

# Alternatively, you could define the service instance(s) first and use the
# following:

service_instance_list = [service_instance]
discovery_response = tm10.DiscoveryResponse(
        message_id=tm10.generate_message_id(),
        in_response_to=discovery_request.message_id,
        service_instances=service_instance_list)

Feed Information Request

class libtaxii.messages_10.FeedInformationRequest(message_id, in_response_to=None, extended_headers=None)[source]

A TAXII Feed Information Request message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional

Example:

ext_headers = {'name1': 'val1', 'name2': 'val2'}
feed_information_request= tm10.FeedInformationRequest(
        message_id=tm10.generate_message_id(),
        extended_headers=ext_headers)

Feed Information Response

class libtaxii.messages_10.FeedInformationResponse(message_id, in_response_to, extended_headers=None, feed_informations=None)[source]

A TAXII Feed Information Response message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • feed_informations (list of FeedInformation) – A list of FeedInformation objects to be contained in this response. Optional
class libtaxii.messages_10.FeedInformation(feed_name, feed_description, supported_contents, available=None, push_methods=None, polling_service_instances=None, subscription_methods=None)[source]

The Feed Information component of a TAXII Feed Information Response Message.

Parameters:
  • feed_name (str) – the name by which this TAXII Data Feed is identified. Required
  • feed_description (str) – a prose description of this TAXII Data Feed. Required
  • supported_contents (list of str) – Content Binding IDs indicating which types of content are currently expressed in this TAXII Data Feed. Required
  • available (boolean) – whether the identity of the requester (authenticated or otherwise) is allowed to access this TAXII Service. Optional Default: None, indicating “unknown”
  • push_methods (list of PushMethod objects) – the protocols that can be used to push content via a subscription. Optional
  • polling_service_instances (list of PollingServiceInstance objects) – the bindings and address a Consumer can use to interact with a Poll Service instance that supports this TAXII Data Feed. Optional
  • subscription_methods (list of SubscriptionMethod objects) – the protocol and address of the TAXII Daemon hosting the Feed Management Service that can process subscriptions for this TAXII Data Feed. Optional

The absense of push_methods indicates no push methods. The absense of polling_service_instances indicates no polling services. At least one of push_methods and polling_service_instances must not be empty. The absense of subscription_methods indicates no subscription services.

class libtaxii.messages_10.PushMethod(push_protocol, push_message_bindings)[source]

The Push Method component of a TAXII Feed Information component.

Parameters:
  • push_protocol (str) – a protocol binding that can be used to push content to an Inbox Service instance. Required
  • push_message_bindings (list of str) – the message bindings that can be used to push content to an Inbox Service instance using the protocol identified in the Push Protocol field. Required
class libtaxii.messages_10.PollingServiceInstance(poll_protocol, poll_address, poll_message_bindings)[source]

The Polling Service Instance component of a TAXII Feed Information component.

Parameters:
  • poll_protocol (str) – the protocol binding supported by this Poll Service instance. Required
  • poll_address (str) – the address of the TAXII Daemon hosting this Poll Service instance. Required
  • poll_message_bindings (list of str) – the message bindings supported by this Poll Service instance. Required
class libtaxii.messages_10.SubscriptionMethod(subscription_protocol, subscription_address, subscription_message_bindings)[source]

The Subscription Method component of a TAXII Feed Information component.

Parameters:
  • subscription_protocol (str) – the protocol binding supported by this Feed Management Service instance. Required
  • subscription_address (str) – the address of the TAXII Daemon hosting this Feed Management Service instance. Required.
  • subscription_message_bindings (list of str) – the message bindings supported by this Feed Management Service Instance. Required

Example:

push_method1 = tm10.PushMethod(
        push_protocol=VID_TAXII_HTTP_10,
        push_message_bindings=[VID_TAXII_XML_10])

polling_service1 = tm10.PollingServiceInstance(
        poll_protocol=VID_TAXII_HTTP_10,
        poll_address='http://example.com/PollService/',
        poll_message_bindings=[VID_TAXII_XML_10])

subscription_service1 = tm10.SubscriptionMethod(
        subscription_protocol=VID_TAXII_HTTP_10,
        subscription_address='http://example.com/SubsService/',
        subscription_message_bindings=[VID_TAXII_XML_10])

feed1 = tm10.FeedInformation(
        feed_name='Feed1',
        feed_description='Description of a feed',
        supported_contents=[CB_STIX_XML_10],
        available=True,
        push_methods=[push_method1],
        polling_service_instances=[polling_service1],
        subscription_methods=[subscription_service1])

feed_information_response1 = tm10.FeedInformationResponse(
        message_id=tm10.generate_message_id(),
        in_response_to=tm10.generate_message_id(),
        feed_informations=[feed1])

Manage Feed Subscription Request

class libtaxii.messages_10.ManageFeedSubscriptionRequest(message_id, extended_headers=None, feed_name=None, action=None, subscription_id=None, delivery_parameters=None)[source]

A TAXII Manage Feed Subscription Request message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
  • action (str) – the requested action to take. Required
  • subscription_id (str) – the ID of a previously created subscription. Required if action==ACT_UNSUBSCRIBE, else Prohibited.
  • delivery_parameters (list of DeliveryParameters) – the delivery parameters for this request. Optional Absence means delivery is not requested.

Example:

delivery_parameters1 = tm10.DeliveryParameters(
        inbox_protocol=VID_TAXII_HTTP_10,
        inbox_address='http://example.com/inbox',
        delivery_message_binding=VID_TAXII_XML_10,
        content_bindings=[CB_STIX_XML_10])

manage_feed_subscription_request1 = tm10.ManageFeedSubscriptionRequest(
        message_id=tm10.generate_message_id(),
        feed_name='SomeFeedName',
        action=ACT_UNSUBSCRIBE,
        subscription_id='SubsId056',
        delivery_parameters=delivery_parameters1)

Manage Feed Subscription Response

class libtaxii.messages_10.ManageFeedSubscriptionResponse(message_id, in_response_to, extended_headers=None, feed_name=None, message=None, subscription_instances=None)[source]

A TAXII Manage Feed Subscription Response message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
  • message (str) – additional information for the message recipient. Optional
  • subscription_instances (list of SubscriptionInstance) – Optional
class libtaxii.messages_10.SubscriptionInstance(subscription_id, delivery_parameters=None, poll_instances=None)[source]

The Subscription Instance component of the Manage Feed Subscription Response message.

Parameters:
  • subscription_id (str) – the id of the subscription. Required
  • delivery_parameters (DeliveryParameters) – the parameters for this subscription. Required if responding to message with action==ACT_STATUS, otherwise Prohibited
  • poll_instances (list of PollInstance) – Each Poll Instance represents an instance of a Poll Service that can be contacted to retrieve content associated with the new Subscription. Optional
class libtaxii.messages_10.PollInstance(poll_protocol, poll_address, poll_message_bindings=None)[source]

The Poll Instance component of the Manage Feed Subscription Response message.

Parameters:
  • poll_protocol (str) – The protocol binding supported by this instance of a Polling Service. Required
  • poll_address (str) – the address of the TAXII Daemon hosting this Poll Service. Required
  • poll_message_bindings (list of str) – one or more message bindings that can be used when interacting with this Poll Service instance. Required

Example:

poll_instance1 = tm10.PollInstance(
        poll_protocol=VID_TAXII_HTTP_10,
        poll_address='http://example.com/poll',
        poll_message_bindings=[VID_TAXII_XML_10])

subscription_instance1 = tm10.SubscriptionInstance(
        subscription_id='SubsId234',
        delivery_parameters=[delivery_parameters1],
        poll_instances=[poll_instance1])

manage_feed_subscription_response1 = tm10.ManageFeedSubscriptionResponse(
        message_id=tm10.generate_message_id(),
        in_response_to="12345",
        feed_name='Feed001',
        message='This is a message',
        subscription_instances=[subscription_instance1])

Poll Request

class libtaxii.messages_10.PollRequest(message_id, extended_headers=None, feed_name=None, exclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, content_bindings=None)[source]

A TAXII Poll Request message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • feed_name (str) – the name of the TAXII Data Feed that is being polled. Required
  • exclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range of TAXII Data Feed content the requester wishes to receive. Optional
  • inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range of TAXII Data Feed content the requester wishes to receive. Optional
  • subscription_id (str) – the existing subscription the Consumer wishes to poll. Optional
  • content_bindings (list of str) – the type of content that is requested in the response to this poll. Optional, defaults to accepting all content bindings.

Example:

poll_request1 = tm10.PollRequest(
        message_id=tm10.generate_message_id(),
        feed_name='TheFeedToPoll',
        exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
        inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
        subscription_id='SubsId002',
        content_bindings=[CB_STIX_XML_10])

Poll Response

class libtaxii.messages_10.PollResponse(message_id, in_response_to, extended_headers=None, feed_name=None, inclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, message=None, content_blocks=None)[source]

A TAXII Poll Response message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • feed_name (str) – the name of the TAXII Data Feed that was polled. Required
  • inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range this response covers. Optional
  • inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range this response covers. Required
  • subscription_id (str) – the Subscription ID for which this content is being provided. Optional
  • message (str) – additional information for the message recipient. Optional
  • content_blocks (list of ContentBlock) – piece of content and additional information related to the content. Optional

Example:

poll_response1 = tm10.PollResponse(
        message_id=tm10.generate_message_id(),
        in_response_to="12345",
        feed_name='FeedName',
        inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
        inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
        subscription_id='SubsId001',
        message='This is a message.',
        content_blocks=[])

Inbox Message

class libtaxii.messages_10.InboxMessage(message_id, in_response_to=None, extended_headers=None, message=None, subscription_information=None, content_blocks=None)[source]

A TAXII Inbox message.

Parameters:
  • message_id (str) – A value identifying this message. Required
  • extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
  • message (str) – prose information for the message recipient. Optional
  • subscription_information (SubscriptionInformation) – This field is only present if this message is being sent to provide content in accordance with an existing TAXII Data Feed subscription. Optional
  • content_blocks (list of ContentBlock) – Inbox content. Optional
class libtaxii.messages_10.SubscriptionInformation(feed_name, subscription_id, inclusive_begin_timestamp_label, inclusive_end_timestamp_label)[source]

The Subscription Information component of a TAXII Inbox message.

Parameters:
  • feed_name (str) – the name of the TAXII Data Feed from which this content is being provided. Required
  • subscription_id (str) – the Subscription ID for which this content is being provided. Required
  • inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the time range this Inbox Message covers. Optional
  • inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the time range this Inbox Message covers. Optional

Example:

cb1 = tm10.ContentBlock(CB_STIX_XML_11, "")

subscription_information1 = tm10.SubscriptionInformation(
        feed_name='SomeFeedName',
        subscription_id='SubsId021',
        inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
        inclusive_end_timestamp_label=datetime.datetime.now(tzutc()))

inbox_message1 = tm10.InboxMessage(
        message_id=tm10.generate_message_id(),
        message='This is a message.',
        subscription_information=subscription_information1,
        content_blocks=[cb1])

Other Classes

class libtaxii.messages_10.TAXIIMessage(message_id, in_response_to=None, extended_headers=None)[source]

Encapsulate properties common to all TAXII Messages (such as headers).

This class is extended by each Message Type (e.g., DiscoveryRequest), with each subclass containing subclass-specific information

class libtaxii.messages_10.ContentBlock(content_binding, content, timestamp_label=None, padding=None)[source]

A TAXII Content Block.

Parameters:
  • content_binding (str) – a Content Binding ID or nesting expression indicating the type of content contained in the Content field of this Content Block. Required
  • content (string or etree) – a piece of content of the type specified by the Content Binding. Required
  • timestamp_label (datetime) – the Timestamp Label associated with this Content Block. Optional
  • padding (string) – an arbitrary amount of padding for this Content Block. Optional

Example:

cb1 = tm10.ContentBlock(
        content_binding=CB_STIX_XML_10,
        content='<stix:STIX_Package xmlns:stix="http://stix.mitre.org/stix-1"/>')
class libtaxii.messages_10.DeliveryParameters(inbox_protocol=None, inbox_address=None, delivery_message_binding=None, content_bindings=None)[source]

Delivery Parameters.

Parameters:
  • inbox_protocol (str) – identifies the protocol to be used when pushing TAXII Data Feed content to a Consumer’s TAXII Inbox Service implementation. Required
  • inbox_address (str) – identifies the address of the TAXII Daemon hosting the Inbox Service to which the Consumer requests content for this TAXII Data Feed to be delivered. Required
  • delivery_message_binding (str) – identifies the message binding to be used to send pushed content for this subscription. Required
  • content_bindings (list of str) – contains Content Binding IDs indicating which types of contents the Consumer requests to receive for this TAXII Data Feed. Optional

Functions

libtaxii.messages_10.generate_message_id(maxlen=5, version=’urn:taxii.mitre.org:services:1.0’)[source]

Generate a TAXII Message ID.

Parameters:maxlen (int) – maximum length of the ID, in characters

Example

msg_id = tm11.generate_message_id()
message = tm11.DiscoveryRequest(msg_id)
# Or...
message = tm11.DiscoveryRequest(tm11.generate_message_id())
libtaxii.messages_10.validate_xml(xml_string)[source]

Note that this function has been deprecated. Please see libtaxii.validators.SchemaValidator.

Validate XML with the TAXII XML Schema 1.0.

Parameters:xml_string (str) – The XML to validate.

Example

is_valid = tm10.validate_xml(message.to_xml())
libtaxii.messages_10.get_message_from_xml(xml_string, encoding=’utf_8’)[source]

Create a TAXIIMessage object from an XML string.

This function automatically detects which type of Message should be created based on the XML.

Parameters:xml_string (str) – The XML to parse into a TAXII message.

Example

message_xml = message.to_xml()
new_message = tm10.get_message_from_xml(message_xml)
libtaxii.messages_10.get_message_from_dict(d)[source]

Create a TAXIIMessage object from a dictonary.

This function automatically detects which type of Message should be created based on the ‘message_type’ key in the dictionary.

Parameters:d (dict) – The dictionary to build the TAXII message from.

Example

message_dict = message.to_dict()
new_message = tm10.get_message_from_dict(message_dict)
libtaxii.messages_10.get_message_from_json(json_string, encoding=’utf_8’)[source]

Create a TAXIIMessage object from a JSON string.

This function automatically detects which type of Message should be created based on the JSON.

Parameters:json_string (str) – The JSON to parse into a TAXII message.