README
T
CompOp
T
ComparisonExpr
T
Document
T
FieldSpec
- ::atIssue::at
- ::code_nameIssue::code_name
T
ObjectKind
T
ObjectPath
T
PathStep
T
PatternExpr
T
PatternValue
T
StixBundle
- ::messageStixError::message
T
StixId
T
StixObject
T
Timestamp
T
Tok
T
TypeSpec
T
ValueShape
V
common_relationship_types
V
document_objects
V
id_type_matches
V
is_common_relationship_type
V
is_open_vocab_value
V
issue
V
known_type_names
V
lookup_type_spec
V
object_kind_of
V
parse_and_validate
V
parse_document
V
parse_document_json
V
parse_pattern
V
parse_stix_id
V
parse_timestamp
V
pattern_object_types
V
relationship_allowed
V
stringify_document
V
timestamp_is_rfc3339
V
valid_email
V
valid_hex_binary
V
valid_ipv4
V
valid_ipv6
V
valid_mac
V
valid_stix_type_name
V
valid_stix_uuid
V
valid_url
V
validate_document
V
validate_pattern_paths
V
vocab_contains
V
vocab_values

moonstix

OASIS STIX 2.1 cyber threat intelligence objects, bundles, and patterning for MoonBit

stix

stix2

cti

threat-intelligence

bundle

Download zip

Author

2200732518gjy

Version

0.1.0

License

Apache-2.0

Repository

github.com/2200732518gjy/moonstix

Last updated

2 hours ago

Downloads

#2200732518gjy/moonstix

CompOp

source

pub(all) enum CompOp {
  Eq
  Ne
  Gt
  Lt
  Ge
  Le
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Comparison operator in a STIX observation.

ComparisonExpr

source

pub(all) enum ComparisonExpr {
  Compare(ObjectPath, CompOp, PatternValue)
  In(ObjectPath, Array[PatternValue])
  Like(ObjectPath, String)
  Matches(ObjectPath, String)
  IsSubset(ObjectPath, String)
  IsSuperset(ObjectPath, String)
  Exists(ObjectPath)
  Not(ComparisonExpr)
  And(ComparisonExpr, ComparisonExpr)
  Or(ComparisonExpr, ComparisonExpr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Boolean comparison expression inside [...].

Document

source

pub(all) enum Document {
  Bundle(StixBundle)
  Object(StixObject)
} derive(@moonbitlang/core/debug.Debug
Debug)

A document is either a bundle or a single object.

FieldSpec

source

pub(all) struct FieldSpec {
  name : String
  required : Bool
  shape : ValueShape
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

One named property in a type table.

Issue

source

pub(all) struct Issue {
  code : String
  path : String
  message : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Diagnostic collected while parsing or validating STIX JSON.

Issue::at

source

fn Issue::at(self : Issue) -> String

Issue::code_name

source

fn Issue::code_name(self : Issue) -> String

ObjectKind

source

pub(all) enum ObjectKind {
  Sdo
  Sro
  Sco
  Meta
  Bundle
  Custom
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

High-level STIX object family.

ObjectPath

source

pub(all) struct ObjectPath {
  object_type : String
  steps : Array[PathStep]
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

type:property... path used by STIX patterning.

PathStep

source

pub(all) enum PathStep {
  Property(String)
  Index(Int)
  AnyIndex
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

One step of an object path after the type name.

PatternExpr

source

pub(all) enum PatternExpr {
  Observation(ComparisonExpr)
  And(PatternExpr, PatternExpr)
  Or(PatternExpr, PatternExpr)
  FollowedBy(PatternExpr, PatternExpr)
  StartStop(PatternExpr, String, String)
  Within(PatternExpr, String)
  Repeats(PatternExpr, String)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Observation expression tree, including qualifiers.

PatternValue

source

pub(all) enum PatternValue {
  String(String)
  Bool(Bool)
  Number(String)
  Timestamp(String)
  Null
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Constant on the right-hand side of a comparison.

StixBundle

source

pub(all) struct StixBundle {
  id : String
  objects : Array[StixObject]
  raw : Json
} derive(@moonbitlang/core/debug.Debug
Debug)

Bundle of STIX objects.

StixError

source

pub(all) enum StixError {
  JsonSyntax(String)
  NotObject
  UnexpectedRoot(String)
  Pattern(String)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Fatal document-level failure. Property problems are reported as Issue.

StixError::message

source

fn StixError::message(self : StixError) -> String

StixId

source

pub(all) struct StixId {
  type_name : String
  uuid : String
  text : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Parsed STIX identifier: <type>--<uuid>.

StixObject

source

pub(all) struct StixObject {
  stix_type : String
  id : String
  spec_version : String
  kind : ObjectKind
  properties : Map[String, Json]
  raw : Json
} derive(@moonbitlang/core/debug.Debug
Debug)

One STIX object, including custom x-* types.

Timestamp

source

pub(all) struct Timestamp {
  year : Int
  month : Int
  day : Int
  hour : Int
  minute : Int
  second : Int
  fraction : String
  offset_minutes : Int
  text : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Parsed RFC 3339 timestamp used by STIX 2.1 datetime properties.

Tok

source

pub(all) enum Tok {
  Eof
  Ident(String)
  String(String)
  Number(String)
  Timestamp(String)
  LBrack
  RBrack
  LParen
  RParen
  Colon
  Dot
  Star
  Comma
  Eq
  Ne
  Gt
  Lt
  Ge
  Le
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Tokens produced by the STIX patterning lexer.

TypeSpec

source

pub(all) struct TypeSpec {
  type_name : String
  kind : ObjectKind
  fields : Array[FieldSpec]
  require_any : Array[String]
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Per-type property table used by the validator.

ValueShape

source

pub(all) enum ValueShape {
  String
  Boolean
  Integer
  NonNegativeInteger
  Timestamp
  Identifier
  IdentifierOf(String)
  StringList
  IdentifierList
  IdentifierListOf(String)
  OpenVocab(String)
  ClosedVocab(String)
  OpenVocabList(String)
  Hashes
  Dictionary
  ObjectList
  ExternalReferences
  KillChainPhases
  GranularMarkings
  Extensions
  Pattern
  HexBinary
  IPv4
  IPv6
  Mac
  Email
  Url
  Any
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Expected JSON shape of one property.

common_relationship_types

source

fn common_relationship_types() -> Array[String]

Common STIX 2.1 relationship_type values.

document_objects

source

fn document_objects(doc : Document) -> Array[StixObject]

id_type_matches

source

fn id_type_matches(id : StixId, expected : String) -> Bool

is_common_relationship_type

source

fn is_common_relationship_type(name : String) -> Bool

is_open_vocab_value

source

fn is_open_vocab_value(value : String) -> Bool

issue

source

fn issue(code : String, path : String, message : String) -> Issue

known_type_names

source

fn known_type_names() -> Array[String]

lookup_type_spec

source

fn lookup_type_spec(type_name : String) -> TypeSpec?

object_kind_of

source

fn object_kind_of(type_name : String) -> ObjectKind

parse_and_validate

source

fn parse_and_validate(text : String) -> Result[(Document, Array[Issue]), StixError]

Parse JSON and collect STIX validation issues.

parse_document

source

fn parse_document(text : String) -> Result[Document, StixError]

parse_document_json

source

fn parse_document_json(value : Json) -> Result[Document, StixError]

parse_pattern

source

fn parse_pattern(text : String) -> Result[PatternExpr, String]

Parse a STIX 2.1 patterning expression.

parse_stix_id

source

fn parse_stix_id(text : String) -> Result[StixId, String]

parse_timestamp

source

fn parse_timestamp(text : String) -> Result[Timestamp, String]

pattern_object_types

source

fn pattern_object_types(expr : PatternExpr) -> Array[String]

relationship_allowed

source

fn relationship_allowed(source_type : String, rel : String, target_type : String) -> Bool

Whether a (source type, relationship, target type) triple is in the built-in STIX 2.1 constraint table. "*" matches any type.

stringify_document

source

fn stringify_document(doc : Document) -> String

timestamp_is_rfc3339

source

fn timestamp_is_rfc3339(text : String) -> Bool

valid_email

source

fn valid_email(text : String) -> Bool

valid_hex_binary

source

fn valid_hex_binary(text : String) -> Bool

valid_ipv4

source

fn valid_ipv4(text : String) -> Bool

valid_ipv6

source

fn valid_ipv6(text : String) -> Bool

valid_mac

source

fn valid_mac(text : String) -> Bool

valid_stix_type_name

source

fn valid_stix_type_name(name : String) -> Bool

valid_stix_uuid

source

fn valid_stix_uuid(text : String) -> Bool

valid_url

source

fn valid_url(text : String) -> Bool

validate_document

source

fn validate_document(doc : Document) -> Array[Issue]

validate_pattern_paths

source

fn validate_pattern_paths(expr : PatternExpr) -> Array[Issue]

vocab_contains

source

fn vocab_contains(name : String, value : String) -> Bool

vocab_values

source

fn vocab_values(name : String) -> Array[String]

Source Files

Site source Report issue Packages Build queue Skills Statistics

moonstix

#2200732518gjy/moonstix

#CompOp

#ComparisonExpr

#Document

#FieldSpec

#Issue

#Issue::at

#Issue::code_name

#ObjectKind

#ObjectPath

#PathStep

#PatternExpr

#PatternValue

#StixBundle

#StixError

#StixError::message

#StixId

#StixObject

#Timestamp

#Tok

#TypeSpec

#ValueShape

#common_relationship_types

#document_objects

#id_type_matches

#is_common_relationship_type

#is_open_vocab_value

#issue

#known_type_names

#lookup_type_spec

#object_kind_of

#parse_and_validate

#parse_document

#parse_document_json

#parse_pattern

#parse_stix_id

#parse_timestamp

#pattern_object_types

#relationship_allowed

#stringify_document

#timestamp_is_rfc3339

#valid_email

#valid_hex_binary

#valid_ipv4

#valid_ipv6

#valid_mac

#valid_stix_type_name

#valid_stix_uuid

#valid_url

#validate_document

#validate_pattern_paths

#vocab_contains

#vocab_values

Source Files

CompOp

ComparisonExpr

Document

FieldSpec

Issue

Issue::at

Issue::code_name

ObjectKind

ObjectPath

PathStep

PatternExpr

PatternValue

StixBundle

StixError

StixError::message

StixId

StixObject

Timestamp

Tok

TypeSpec

ValueShape

common_relationship_types

document_objects

id_type_matches

is_common_relationship_type

is_open_vocab_value

issue

known_type_names

lookup_type_spec

object_kind_of

parse_and_validate

parse_document

parse_document_json

parse_pattern

parse_stix_id

parse_timestamp

pattern_object_types

relationship_allowed

stringify_document

timestamp_is_rfc3339

valid_email

valid_hex_binary

valid_ipv4

valid_ipv6

valid_mac

valid_stix_type_name

valid_stix_uuid

valid_url

validate_document

validate_pattern_paths

vocab_contains

vocab_values