oasis-open / cti-pattern-validator

OASIS TC Open Repository: Validate patterns used to express cyber observable content in STIX Indicators

Home Page:https://stix2-patterns.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

How to parse a pattern?

ybdesire opened this issue · comments

I want to parse a STIX pattern to get the key-value pairs and "AND OR" logic.

Would you give some suggestions to parse a STIX pattern ? Which APIs to choose?

If I'm reading this correctly, part of what you are describing has been done in the stix-shifter project. The pattern is first parsed with an ANTLR grammar. That gets run through a method that builds up a python list of objects containing the STIX object:attribute, comparison operator, and value. What's missing from this is the AND/OR logic getting returned. Here's the link to the relevant method:
https://github.com/IBM/stix-shifter/blob/master/stix_shifter/stix_translation/src/utils/stix_pattern_parser.py

@delliott90 thanks for the update. It helps.