GitLocker: The Coding Marketplace

Description:

ioc writer 0.3.3

ioc_writer
The source code in this package is made available under the terms of the
Apache License , Version 2.0. See the “LICENSE “ file for more
information.

Status

Author
William Gibb william.gibb at fireeye dot com

Purpose
Provide a python library that allows for basic creation and editing of
OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete)
for various items:

item
Create
Read
Update
Delete

IOC name
Yes
No
Yes
Yes

IOC description
Yes
No
Yes
Yes

created date
Yes
No
Yes
N/A

last modified date
Yes
No
Yes
N/A

published date
Yes
No
Yes
N/A

link metadata
Yes
No
Yes
Yes

IndicatorItem nodes
Yes
No
NotYet
Yes

Indicator nodes
Yes
No
NotYet
Yes

Parameters
Yes
No
Yes
Yes

Items do not have built in Read operations, since all items can be
accesed with built in ElementTree syntax or the use of XPATH to select
portions of the IOC.
No decision has been made about whether or not to support changing of
existing Indicator/IndicatorItem nodes.
See the Docs located at https://pythonhosted.org/ioc_writer/ and the
examples directory for examples of working with the library. The user
code should avoid having to call functionality in ioc_writer.ioc_et.

Requirements
The python “lxml” library must be installed. This can be obtained from
https://pypi.python.org/pypi/lxml

Installation
See the file named “INSTALL” for instructions on installing this library
locally.

Examples
Example code lives in the examples folder of the repository.

examples/11_to_10_downgrade Script to downgrade OpenIOC 1.1 to
OpenIOC 1.1.
examples/openioc_to_yara Scripts that support encapsulating YARA
signatures in OpenIOC 1.1 format.
examples/simple_ioc_writer Script that consumes a csv of data to
build an IOC. this csv contains the content, context, et cetera. An
example CSV is provided.

Bug reports / questions / feedback / feature requests
william.gibb at fireeye dot com