use of org.mitre.cybox.cybox_2.Observable in project metron by apache.
the class StixExtractor method extract.
@Override
public Iterable<LookupKV> extract(String line) throws IOException {
STIXPackage stixPackage = STIXPackage.fromXMLString(line.replaceAll("\"Equal\"", "\"Equals\""));
List<LookupKV> ret = new ArrayList<>();
for (Observable o : getObservables(stixPackage)) {
ObjectType obj = o.getObject();
if (obj != null) {
ObjectPropertiesType props = obj.getProperties();
if (props != null) {
ObjectTypeHandler handler = ObjectTypeHandlers.getHandlerByInstance(props);
if (handler != null) {
if (LOG.isDebugEnabled()) {
LOG.debug("Found {} for properties {}", handler.getTypeClass().getCanonicalName(), props.toXMLString());
}
Iterable<LookupKV> extractions = handler.extract(props, config);
for (LookupKV extraction : extractions) {
ret.add(extraction);
}
} else if (LOG.isDebugEnabled()) {
LOG.debug("Did not find a handler for properties {} of type {}", props.toXMLString(), props.getClass());
}
}
}
}
return ret;
}
use of org.mitre.cybox.cybox_2.Observable in project metron by apache.
the class StixExtractor method getObservables.
public List<Observable> getObservables(STIXPackage stixPackage) {
List<Observable> ret = new ArrayList<>();
Observables observables = stixPackage.getObservables();
if (observables != null) {
for (Observable o : observables.getObservables()) {
ret.add(o);
}
}
if (stixPackage.getIndicators() != null) {
if (stixPackage.getIndicators().getIndicators() != null) {
List<IndicatorBaseType> indicators = stixPackage.getIndicators().getIndicators();
int indicatorCount = indicators.size();
for (int i = 0; i < indicatorCount; i++) {
Indicator indicator = (Indicator) indicators.get(i);
if (indicator.getObservable() != null) {
ret.add(indicator.getObservable());
}
}
}
}
return ret;
}
Aggregations