NOTE: This is an OASIS TC Open Repository. See the Governance section for more information.
The stix-slider is a software tool for 'sliding' STIX 2.x JSON to STIX 1.x XML. Due to the differences between STIX 1.x and STIX 2.x, this conversion is best-effort only. During the conversion, stix-slider provides information on the assumptions it needs to make to produce valid STIX 1.x XML, and what information was not able to be converted.
The stix-slider is a work-in-progress. It should be used to explore how STIX 2.x content could potentially be represented in STIX 1.x. Using the current version of the slider will provide insight to issues that might need to be mitigated to convert your STIX 2.x content for use in application that accept only STIX 1.x content.
It should not be used in a production environment, and should not be considered final.
Please enter any comments on how to improve it into the issue tracker.
For more information, see the documentation on ReadTheDocs.
Python 3.8+
python-stix and its dependencies
Note
Make sure to use either the latest version of python-stix 1.1.1.x or 1.2.0.x, depending on whether you want to support STIX 1.1.1 or STIX 1.2.
python-stix2 >= 3.0.0
stixmarx >= 1.0.8
stix-validator >= 3.0.0
Install with pip:
$ pip install stix2-slider
This will install all necessary dependencies, including the latest version of python-stix.
If you need to support older STIX 1.1.1 content, install python-stix 1.1.1.x first:
$ pip install 'stix<1.2' $ pip install stix2-slider
You can also install the stix-slider from GitHub to get the latest (unstable) version:
$ pip install git+https://github.com/oasis-open/cti-stix-slider.git
It is recommended that you ensure that the input STIX 2.x file is valid before submitting it to the slider. Use the stix2-validator.
The slider comes with a bundled script which you can use to convert STIX 2.x content to STIX 1.x content:
usage: stix2_slider [-h] [--no-squirrel-gaps] [--validator-args VALIDATOR_ARGS]
[-e ENABLE] [-d DISABLE] [-s]
[--message-log-directory MESSAGE_LOG_DIRECTORY]
[--log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}]
[--use-namespace USE_NAMESPACE]
file
stix2-slider v4.0.1
The stix2-slider is a work-in-progress. It should be used to explore how
existing STIX 2.x would potentially be represented in STIX 1.x. Using the
current version of the stix2-slider will provide insight to issues that might need
to be mitigated so you can use an application that supports only STIX 1.x content.
positional arguments: The input STIX 2.x document to be 'slid' to STIX 1.x..
optional arguments:
-h, --help show this help message and exit
--no-squirrel-gaps Do not include STIX 2.x content that cannot be
represented directly in STIX 1.x using the description
property.
--validator-args VALIDATOR_ARGS
Arguments to pass to stix-validator. Example:
stix2_slider <file> --validator-args="--best-
practices"
-e ENABLE, --enable ENABLE
A comma-separated list of the stix2-slider messages to
enable. If the --disable option is not used, no other
messages will be shown. Example: stix2_slider <file>
--enable 250
-d DISABLE, --disable DISABLE
A comma-separated list of the stix2-slider messages to
disable. Example: stix2_slider <file> --disable
212,220
-s, --silent If this flag is set. All stix2-slider messages will be
disabled.
--message-log-directory MESSAGE_LOG_DIRECTORY
If this flag is set, all stix2-slider messages will be
saved to file. The name of the file will be the input
file with extension .log in the specified directory.
Note, make sure the directory already exists. Example:
stix2_slider <file> --message-log-directory "../logs"
--log-level {DEBUG,INFO,WARN,ERROR,CRITICAL}
The logging output level.
--use-namespace USE_NAMESPACE
Override the 'example' namespace with the provided one.
The format is the prefix, namespace uri and optionally
the schema location separated by a space. Example:
stix2_slider <file> --use-namespace="example
http://example.com"
Refer to slider_log_messages.rst for all stix2-slider messages. Use the associated code number
to --enable or --disable a message. By default, the stix2-slider displays all
messages. Note: disabling the message does not disable the functionality.
You can also use this library to integrate STIX 'sliding' into your own tools. You can slide a STIX 2.x file:
from stix2slider import slide_file
from stix2slider.options import initialize_options
initialize_options()
results = slide_file("stix_file.json")
print(results)
Additionally, a similar method exists to accept a string as an argument:
from stix2slider import slide_string
from stix2slider.options import initialize_options
initialize_options()
results = slide_string("...")
print(results)
To set options, use set_option_value, found in options.py.
This GitHub public repository ( https://github.com/oasis-open/cti-stix-slider ) was was created at the request of the the OASIS Cyber Threat Intelligence (CTI) TC as an OASIS TC Open Repository to support development of open source resources related to Technical Committee work.
While this TC Open Repository remains associated with the sponsor TC, its development priorities, leadership, intellectual property terms, participation rules, and other matters of governance are separate and distinct from the OASIS TC Process and related policies.
All contributions made to this TC Open Repository are subject to open source license terms expressed in the BSD-3-Clause License. That license was selected as the declared "Applicable License" when the TC Open Repository was created.
As documented in "Public Participation Invited", contributions to this OASIS TC Open Repository are invited from all parties, whether affiliated with OASIS or not. Participants must have a GitHub account, but no fees or OASIS membership obligations are required. Participation is expected to be consistent with the OASIS TC Open Repository Guidelines and Procedures, the open source LICENSE designated for this particular repository, and the requirement for an Individual Contributor License Agreement that governs intellectual property.
Statement of Purpose for this OASIS TC Open Repository (cti-stix- slider) as proposed and approved [bis] by the TC:
This GitHub public repository is provided to support version- controlled development of a Python "slider" application which will convert STIX 2.x content to STIX 1.x content.
TC Open Repository Maintainers are responsible for oversight of this project's community development activities, including evaluation of GitHub pull requests and preserving open source principles of openness and fairness. Maintainers are recognized and trusted experts who serve to implement community goals and consensus design preferences.
Initially, the associated TC members have designated one or more persons to serve as Maintainer(s); subsequently, participating community members may select additional or substitute Maintainers, per consensus agreements.
Current Maintainers of this TC Open Repository
- Jason Keirstead; GitHub ID: https://github.com/JasonKeirstead; WWW: Cyware Labs
- TC Open Repositories: Overview and Resources
- Frequently Asked Questions
- Open Source Licenses
- Contributor License Agreements (CLAs)
- Maintainers' Guidelines and Agreement
Questions or comments about this TC Open Repository's activities should be composed as GitHub issues or comments. If use of an issue/comment is not possible or appropriate, questions may be directed by email to the Maintainer(s) listed above. Please send general questions about TC Open Repository participation to OASIS Staff at repository-admin@oasis-open.org and any specific CLA-related questions to repository-cla@oasis-open.org.