FinCyber_UK_Consuming_Intel_Shared_Via_STIX_TAXII.ipynb

{
  "cells": [
    {
      "cell_type": "markdown",
      "id": "239a121e",
      "metadata": {
        "id": "239a121e"
      },
      "source": [
        "\n",
        "# CYTAXII2, Cyware's TAXII 2.x Client\n",
        "\n",
        "cytaxii2 is a pip library [for python 3] by Cyware that can be used to connect to and, discover, get collections, poll and inbox data from and to a TAXII 2.x server. This supports stix/taxii 2, 2.1\n",
        "\n",
        "A pair of TAXII credentials can be received at https://cyware.com/resources/threat-intel-feeds"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "24015eb5",
      "metadata": {
        "id": "24015eb5"
      },
      "source": [
        "This library supports python3 and can be installed by \"pip3 install cytaxii2\". After installation the library can be imported as follows:"
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!pip3 install requests"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Iu8SwaHqUFrZ",
        "outputId": "1ebd944a-eb1c-46ec-d829-399389f9c96e"
      },
      "id": "Iu8SwaHqUFrZ",
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Requirement already satisfied: requests in /usr/local/lib/python3.10/dist-packages (2.32.3)\n",
            "Requirement already satisfied: charset-normalizer<4,>=2 in /usr/local/lib/python3.10/dist-packages (from requests) (3.3.2)\n",
            "Requirement already satisfied: idna<4,>=2.5 in /usr/local/lib/python3.10/dist-packages (from requests) (3.10)\n",
            "Requirement already satisfied: urllib3<3,>=1.21.1 in /usr/local/lib/python3.10/dist-packages (from requests) (2.0.7)\n",
            "Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python3.10/dist-packages (from requests) (2024.8.30)\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "import json"
      ],
      "metadata": {
        "id": "diNRtIoJLXYy"
      },
      "id": "diNRtIoJLXYy",
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "93c223ae",
      "metadata": {
        "id": "93c223ae"
      },
      "outputs": [],
      "source": [
        "import requests\n",
        "\n",
        "\"\"\"\n",
        "Cyware TAXII 2.0/ 2.1 Client\n",
        "TAXII Supported Version: 2.0 & 2.1\n",
        "\"\"\"\n",
        "\n",
        "\n",
        "class cytaxii2(object):\n",
        "    def __init__(self, discovery_url, username, password, version=2.1, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to initialize values throughout the class\n",
        "        :param discovery_url: Enter the TAXII 2.1 Discovery URL\n",
        "        :param username: Enter the username to to authenticate with\n",
        "        :param password: Enter the password to to authenticate with\n",
        "        \"\"\"\n",
        "        if version == 2.1:\n",
        "            self.headers = {\n",
        "                'Content-Type': 'application/taxii+json;version=2.1',\n",
        "                'User-Agent': 'cyware.taxii2client',\n",
        "                'Accept': 'application/taxii+json;version=2.1'\n",
        "            }\n",
        "        elif version == 2.0:\n",
        "            self.headers = {\n",
        "                'Content-Type': 'application/vnd.oasis.stix+json; version=2.0',\n",
        "                'User-Agent': 'cyware.httpclient',\n",
        "                'Accept': 'application/vnd.oasis.taxii+json; version=2.0'\n",
        "            }\n",
        "        else:\n",
        "            raise SyntaxError(\"Invalid version entered. Only TAXII versions 2.0 and 2.1 are supported\")\n",
        "\n",
        "        self.discovery_url = discovery_url\n",
        "        self.auth = (username, password)\n",
        "        self.collections = \"collections\"\n",
        "        self.objects = \"objects\"\n",
        "\n",
        "    def request_handler(self, method, url, json_data=None, query_params=None, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to handle all TAXII requests\n",
        "        :param query_params: Any query params to pass\n",
        "        :param method: Enter the HTTP method to use\n",
        "        :param url: Enter the URL to make the request to\n",
        "        :param json_data: Enter the json data to pass as a payload\n",
        "        \"\"\"\n",
        "        try:\n",
        "            if method == 'GET':\n",
        "                response = requests.get(url=url, data=json_data, headers=self.headers, auth=self.auth,\n",
        "                                        params=query_params)\n",
        "            elif method == 'POST':\n",
        "                response = requests.post(url=url, data=json_data, headers=self.headers, auth=self.auth,\n",
        "                                         params=query_params)\n",
        "            else:\n",
        "                return {\n",
        "                    'response': 'Unsupported Method requested',\n",
        "                    'status': False,\n",
        "                    'status_code': 405\n",
        "                }\n",
        "\n",
        "            status_code = response.status_code\n",
        "\n",
        "            if response.ok:\n",
        "                response_json = response.json()\n",
        "                status = True\n",
        "            else:\n",
        "                response_json = response.text\n",
        "                status = False\n",
        "\n",
        "        except Exception as e:\n",
        "            status_code = 'EXCEPTION'\n",
        "            response_json = str(e)\n",
        "            status = False\n",
        "\n",
        "        return {\n",
        "            'response': response_json,\n",
        "            'status': status,\n",
        "            'status_code': status_code\n",
        "        }\n",
        "\n",
        "    def discovery_request(self, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to make a request to the TAXII discovery URL\n",
        "        \"\"\"\n",
        "        response = self.request_handler(method='GET', url=self.discovery_url)\n",
        "        return response\n",
        "\n",
        "    def root_discovery(self, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to make a root discovery request to the TAXII URL\n",
        "        \"\"\"\n",
        "        discover_response = self.discovery_request()\n",
        "        if discover_response['status_code'] == 200:\n",
        "            api_root = discover_response['response']['default']\n",
        "            response = self.request_handler(method='GET', url=api_root)\n",
        "            return response\n",
        "        else:\n",
        "            return discover_response\n",
        "\n",
        "    def collection_request(self, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to make a request to the TAXII server to get all collections on the server\n",
        "        \"\"\"\n",
        "        collection_url = \"{0}/{1}/\".format(self.discovery_url.rstrip(\"/\"), self.collections)\n",
        "        response = self.request_handler(method='GET', url=collection_url)\n",
        "        return response\n",
        "\n",
        "    def collection_data_request(self, collection_id, **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to get data about a particular collection on the TAXII server\n",
        "        :param collection_id: Enter the collection ID\n",
        "        \"\"\"\n",
        "        poll_url = \"{0}/{1}/{2}/\".format(self.discovery_url.rstrip(\"/\"), self.collections, collection_id)\n",
        "        response = self.request_handler(method='GET', url=poll_url)\n",
        "        return response\n",
        "\n",
        "    def poll_request(self, collection_id, added_after=None, limit=None, object_id=None, next=None, object_type=None,\n",
        "                     **kwargs):\n",
        "        \"\"\"\n",
        "        This method is used to poll data from a particular collection\n",
        "        :param object_type: Enter the indicator type to retrieve\n",
        "        :param next: Enter the next integer if the data has been paginated\n",
        "        :param object_id: Enter a specific object to retrieve\n",
        "        :param limit: Enter response limit\n",
        "        :param added_after: Enter the date to poll from, polls all data if left blank\n",
        "        :param collection_id: Enter the collection ID\n",
        "        \"\"\"\n",
        "        params = {\n",
        "            'added_after': added_after,\n",
        "            'limit': limit,\n",
        "            'next': next,\n",
        "            'match[id]': object_id,\n",
        "            'match[type]': object_type\n",
        "        }\n",
        "        poll_url = \"{0}/{1}/{2}/{3}/\".format(self.discovery_url.rstrip(\"/\"), self.collections, collection_id, self.objects)\n",
        "        response = self.request_handler(method='GET', url=poll_url, query_params=params)\n",
        "        return response\n"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "281d841c",
      "metadata": {
        "id": "281d841c"
      },
      "source": [
        "After importing, we have to create an object with the TAXII URL, username and password and TAXII version [2.0/ 2.1], as follows:"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "4a112e53",
      "metadata": {
        "id": "4a112e53"
      },
      "outputs": [],
      "source": [
        "cytaxii_object = cytaxii2(\n",
        "    discovery_url='https://threatfeed.cyware.com/ctixapi/ctix21/',\n",
        "             username='<username>',\n",
        "             password='<password>',\n",
        "             version=2.1, verify=False)"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "af14c300",
      "metadata": {
        "id": "af14c300"
      },
      "source": [
        "After the object is created we can call the methods present in the library. Each of the methods are highlighted below."
      ]
    },
    {
      "cell_type": "markdown",
      "id": "609bad9e",
      "metadata": {
        "id": "609bad9e"
      },
      "source": [
        "The first method is where we can perform a TAXII discovery request and can be done as follows.\n",
        "\n",
        "##### Arguments\n",
        "None"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "584fbf6f",
      "metadata": {
        "id": "584fbf6f",
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "outputId": "8b5b17c8-6f96-4e63-a973-dcd871ff4aaf"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "{\n",
            "    \"response\": {\n",
            "        \"title\": \"ThreatFeed TAXII 2.1 API Root\",\n",
            "        \"description\": \"TAXII 2.1 service for ThreatFeed user\",\n",
            "        \"versions\": [\n",
            "            \"application/taxii+json;version=2.1\"\n",
            "        ],\n",
            "        \"max_content_length\": 10000000\n",
            "    },\n",
            "    \"status\": true,\n",
            "    \"status_code\": 200\n",
            "}\n"
          ]
        }
      ],
      "source": [
        "discovery_response = cytaxii_object.discovery_request()\n",
        "print(json.dumps(discovery_response, indent=4))"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "8a8cd6a2",
      "metadata": {
        "id": "8a8cd6a2"
      },
      "source": [
        "Next, we can perform a collection request, where we request all STIX data collections from the TAXII server. We must note in TAXII all data is held inside a collection and a list of collections can be requested as follows.\n",
        "\n",
        "##### Arguments\n",
        "None"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "5545a122",
      "metadata": {
        "id": "5545a122",
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "outputId": "cc8008cb-6b49-4206-9df7-838c13a055d5"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "{\n",
            "    \"response\": {\n",
            "        \"collections\": [\n",
            "            {\n",
            "                \"id\": \"46cc884e-fd37-4436-95b3-ac73710df3dc\",\n",
            "                \"title\": \"ThreatFox\",\n",
            "                \"description\": \"ThreatFox is a project operated by abuse.ch. The purpose of the project is to collect and share indicators of compromise (IOCs), helping IT-security researchers and threat analysts protecting their constituency and customers from cyber threats.\",\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"52ab6ed4-83d0-42fb-891c-708221648181\",\n",
            "                \"title\": \"default\",\n",
            "                \"description\": \"Default collection of ctix\",\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": true,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"1ae57e3d-810c-450c-a97f-eb60b63c896c\",\n",
            "                \"title\": \"Malware Bazaar\",\n",
            "                \"description\": \"Server STIX collection for Malware Bazaar\",\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"694bc05f-9568-4738-ac66-7c3fb119ff75\",\n",
            "                \"title\": \"Das Malwerk\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"8eafbfb4-6213-4ff8-9de4-978aa5fdc59f\",\n",
            "                \"title\": \"Stop Forum Spam\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"ebf09405-9e6d-45ae-a6c0-038492af3ee8\",\n",
            "                \"title\": \"Ipsum\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"ffa5a722-0e00-41de-9b70-b1fbeed9ff9f\",\n",
            "                \"title\": \"Neo23x0\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"8f14d378-f537-491f-ae82-68580fcfb73a\",\n",
            "                \"title\": \"Dataplane\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"34e7e24a-1bad-48f1-b88d-bdfd5f99a6bd\",\n",
            "                \"title\": \"VoIPBL\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"4656fc49-0ff8-460e-8aff-1be93b0a488f\",\n",
            "                \"title\": \"Darklist De\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"ab7c3de4-5368-4e87-9dc4-32ff37f14590\",\n",
            "                \"title\": \"Sblam\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"557bb369-e002-4d99-9908-d709a45b9e56\",\n",
            "                \"title\": \"Project HoneyPot\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"c0cf066e-3ad7-4723-8034-15cd28d4194a\",\n",
            "                \"title\": \"CINS Score\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"81a20383-0147-4b3a-94a9-ebf13a12ff88\",\n",
            "                \"title\": \"Pgl Yoyo\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"dd37a39e-42cc-42a1-9ca5-fd494b8a3100\",\n",
            "                \"title\": \"Brute Force Blocker\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"ed26345f-365c-401c-919b-c1c216e78b00\",\n",
            "                \"title\": \"Botscout\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"6ab49abf-a67b-42cd-a90c-045644a515c0\",\n",
            "                \"title\": \"Cyware Vulnerability Feed\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"007cc299-9600-4ff4-ab0b-83c734903041\",\n",
            "                \"title\": \"Talos Intelligence\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"b47bafb6-f8b3-4707-9c10-1fbe9550e2a3\",\n",
            "                \"title\": \"Dshield\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"8de5d7d7-1c5a-4d81-9110-aa2e10bd74dc\",\n",
            "                \"title\": \"Cyber Cure\",\n",
            "                \"description\": \"cybercure_collection\",\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"af63b2ef-2b08-4d11-a2a4-2c913eafebce\",\n",
            "                \"title\": \"Emerging Threats Fwip\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"5ea46dc9-bdff-45c8-a7b1-bfd925799e80\",\n",
            "                \"title\": \"Tor Feed\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"0824ead0-73f0-4b49-83ad-109077a2a4a5\",\n",
            "                \"title\": \"Honey Db\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"c208ded2-ecac-41d3-9d68-9c4941bc0520\",\n",
            "                \"title\": \"Botvrij\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"57bb261a-417e-47df-abb5-db5755db969a\",\n",
            "                \"title\": \"VirusShare\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"edfb8789-4123-405b-a074-941c98ff1037\",\n",
            "                \"title\": \"Binary Defense Banlist\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"ce1d5d4a-4ea8-4479-a0c0-bc7dbdffe6e1\",\n",
            "                \"title\": \"Phishtank\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"5c196ffb-5e07-42e6-b633-7d6e07f4120b\",\n",
            "                \"title\": \"Malshare\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"9dc267ed-e7cd-4e2c-8d0e-6536a8b68d53\",\n",
            "                \"title\": \"Abuse.ch SSL\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"f50c9e8a-2fdd-49be-884d-547713b9ec37\",\n",
            "                \"title\": \"Blocklist De\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"c459cb37-a52f-4e22-9e61-e5d781a2d6d6\",\n",
            "                \"title\": \"OpenPhish\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"9142afa9-a320-4ae9-b2e5-9f4cebbf0b02\",\n",
            "                \"title\": \"Greensnow\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"7b2df77e-09d7-4311-bebc-6a4f3a18c417\",\n",
            "                \"title\": \"Dan Tor\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"8a8723f3-1239-4d30-b9a5-3dc44a513b50\",\n",
            "                \"title\": \"Url Haus\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"62b47777-1416-493a-aaa0-cb500c5a64c8\",\n",
            "                \"title\": \"Vxvault\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"f9f25677-588a-4db7-b3d5-42bab03c4d19\",\n",
            "                \"title\": \"Snort Feed\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"39d4411c-5727-4d79-89d6-12bc3a2ae129\",\n",
            "                \"title\": \"Pop3 Gropers\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"23adb570-86e8-4307-95c4-ca503247933b\",\n",
            "                \"title\": \"Feodo\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"c87ba8b3-321a-440b-9f7c-f06ff7e9fe51\",\n",
            "                \"title\": \"Emerging Threats\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"8332ed3d-935a-4211-8da1-7f6ddc40fd97\",\n",
            "                \"title\": \"Cybercrime Tracker\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"da01d857-df1a-484a-b5fa-f0426b5880af\",\n",
            "                \"title\": \"Coin Blocker\",\n",
            "                \"description\": null,\n",
            "                \"can_read\": true,\n",
            "                \"can_write\": false,\n",
            "                \"media_types\": [\n",
            "                    \"application/stix+json;version=2.1\"\n",
            "                ]\n",
            "            }\n",
            "        ]\n",
            "    },\n",
            "    \"status\": true,\n",
            "    \"status_code\": 200\n",
            "}\n"
          ]
        }
      ],
      "source": [
        "collections = cytaxii_object.collection_request()\n",
        "print(json.dumps(collections, indent=4))"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "9ec9f8fd",
      "metadata": {
        "id": "9ec9f8fd"
      },
      "source": [
        "Next, we can also get data about a particular TAXII collection URL and this can be done as follow.\n",
        "\n",
        "##### Arguments:\n",
        "- collection_id: Enter the collection ID to get details of __[mandatory]__"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "b4bec046",
      "metadata": {
        "id": "b4bec046",
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "outputId": "46041950-f3ce-481d-daf6-db7f18c4355e"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "{\n",
            "    \"response\": {\n",
            "        \"id\": \"46cc884e-fd37-4436-95b3-ac73710df3dc\",\n",
            "        \"title\": \"ThreatFox\",\n",
            "        \"description\": \"ThreatFox is a project operated by abuse.ch. The purpose of the project is to collect and share indicators of compromise (IOCs), helping IT-security researchers and threat analysts protecting their constituency and customers from cyber threats.\",\n",
            "        \"can_read\": true,\n",
            "        \"can_write\": false,\n",
            "        \"media_types\": [\n",
            "            \"application/stix+json;version=2.1\"\n",
            "        ]\n",
            "    },\n",
            "    \"status\": true,\n",
            "    \"status_code\": 200\n",
            "}\n"
          ]
        }
      ],
      "source": [
        "collection_data = cytaxii_object.collection_data_request(collection_id=\"46cc884e-fd37-4436-95b3-ac73710df3dc\")\n",
        "print(json.dumps(collection_data, indent=4))"
      ]
    },
    {
      "cell_type": "markdown",
      "id": "d217e5e0",
      "metadata": {
        "id": "d217e5e0"
      },
      "source": [
        "Next, we can get data from a TAXII collection. This is one of the most important use cases, where we can poll data from a TAXII server.\n",
        "\n",
        "##### Arguments:\n",
        "- collection_id: Enter the collection ID to get details of __[mandatory]__\n",
        "- added_after: Enter a datetime string to parse. Data will be returned only after this date till current data. Defaults to all data\n",
        "- limit: Enter the number of responses to return\n",
        "- object_id: Enter the object_id. This param will limit the response to only this object in the response\n",
        "- object_type: Enter the object type to return\n",
        "- next: If the data is paginated, the \"next\" param can be used to get additional data\n"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "5968b24f",
      "metadata": {
        "id": "5968b24f",
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "outputId": "dbdfa870-b2e2-4c0d-a56a-24f13c0b32ab"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "{\n",
            "    \"response\": {\n",
            "        \"objects\": [\n",
            "            {\n",
            "                \"id\": \"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\",\n",
            "                \"name\": \"TLP:GREEN\",\n",
            "                \"type\": \"marking-definition\",\n",
            "                \"created\": \"2017-01-20T00:00:00.000Z\",\n",
            "                \"definition\": {\n",
            "                    \"tlp\": \"green\"\n",
            "                },\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"definition_type\": \"tlp\"\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\",\n",
            "                \"name\": \"TLP:AMBER\",\n",
            "                \"type\": \"marking-definition\",\n",
            "                \"created\": \"2017-01-20T00:00:00.000Z\",\n",
            "                \"definition\": {\n",
            "                    \"tlp\": \"amber\"\n",
            "                },\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"definition_type\": \"tlp\"\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"indicator--5eca3ac6-0e74-4b9c-9a2c-a09e19104667\",\n",
            "                \"name\": \"None\",\n",
            "                \"type\": \"indicator\",\n",
            "                \"created\": \"2024-04-26T08:21:18.000Z\",\n",
            "                \"pattern\": \"[url:value = 'https://www.dropbox.com/c/scl/fi/uph9kp0ie2xoxfu9iaeqo/BT-BROADBAND.paper?rlkey=xs3l4h55mr4ej27dyseaq49uk&dl=0']\",\n",
            "                \"revoked\": false,\n",
            "                \"modified\": \"2024-04-26T09:09:50.000Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"extensions\": {\n",
            "                    \"extension-definition--5c4546f1-7e76-4b4a-844c-64a1f722c788\": {\n",
            "                        \"extension_type\": \"toplevel-property-extension\"\n",
            "                    }\n",
            "                },\n",
            "                \"valid_from\": \"2024-04-26T13:07:44.515Z\",\n",
            "                \"pattern_type\": \"stix\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"indicator_types\": [\n",
            "                    \"unknown\"\n",
            "                ],\n",
            "                \"x_ctix_confidence_score\": 100,\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--d8653759-b47c-4cef-b21a-602619e8cd76\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:44.519Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:44.519Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--5eca3ac6-0e74-4b9c-9a2c-a09e19104667\",\n",
            "                \"target_ref\": \"indicator--2a2986d6-208b-47ac-b875-c18a0d0e92c6\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--58909d9e-794d-4d4c-a882-46b77022cff8\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:52.653Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:52.653Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--f32c783b-46a2-4600-a108-1e7517efa3c7\",\n",
            "                \"target_ref\": \"indicator--19852523-8810-4879-acc1-65e70a4159f2\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--226b45e2-0132-438d-9be5-f566009e5d1f\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:59.432Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:59.432Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--0c8c6e3d-f17e-4d7f-9b4c-a1834d220efd\",\n",
            "                \"target_ref\": \"indicator--b06236c8-bd88-4ca8-872b-c582ef742026\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--8799f32a-3b64-4b2a-be78-e4225de4f63f\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:08.625Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:08.625Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--431efd1d-a0f5-4949-883d-787184abd769\",\n",
            "                \"target_ref\": \"indicator--5fdc50cb-8e6e-4e4a-92c0-f98186452efa\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--07c7acfe-0ce5-4c7c-b8d8-d63dd5570701\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:09.285Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:09.285Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--7254c6bb-214d-4c24-a84a-96e77d9f050f\",\n",
            "                \"target_ref\": \"indicator--6cf3536c-5abd-4133-b429-3f17c882113f\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--1000b1c7-07f6-458d-9521-63bf6d96a42f\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:16.664Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:16.664Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--838633f7-00d0-495b-b0ef-60f9e3a3c016\",\n",
            "                \"target_ref\": \"indicator--d1539d8c-8f12-4503-8c44-09877f4c1a28\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--b8a83592-3c0f-414d-9708-2f0a6368d6a3\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:40.917Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:40.917Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--46a8167c-1626-4a6d-8dfb-99121661b2c3\",\n",
            "                \"target_ref\": \"indicator--0b4fa6d5-09c5-4ca9-b58d-ae4fa41aa461\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--41e2e353-c227-40b0-8c30-b0667d8e0d62\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:48.595Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:48.595Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--d40f6428-b47a-4e6a-bfe8-1869a821f56a\",\n",
            "                \"target_ref\": \"indicator--3abe9cf6-c8ae-4430-a186-8af1094f1c89\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            },\n",
            "            {\n",
            "                \"id\": \"relationship--ef7c724b-0c61-4a0f-9d36-66487d0e350a\",\n",
            "                \"type\": \"relationship\",\n",
            "                \"created\": \"2024-04-26T13:07:54.294Z\",\n",
            "                \"modified\": \"2024-04-26T13:07:54.294Z\",\n",
            "                \"confidence\": 100,\n",
            "                \"source_ref\": \"indicator--40d72c95-42e3-408f-8608-0995818efb09\",\n",
            "                \"target_ref\": \"indicator--b154887f-d339-46f0-8d2b-f6c7430ea1e9\",\n",
            "                \"spec_version\": \"2.1\",\n",
            "                \"relationship_type\": \"related-to\",\n",
            "                \"object_marking_refs\": [\n",
            "                    \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n",
            "                ]\n",
            "            }\n",
            "        ],\n",
            "        \"more\": true,\n",
            "        \"next\": \"8381729\"\n",
            "    },\n",
            "    \"status\": true,\n",
            "    \"status_code\": 206\n",
            "}\n"
          ]
        }
      ],
      "source": [
        "poll_response = cytaxii_object.poll_request(collection_id='ce1d5d4a-4ea8-4479-a0c0-bc7dbdffe6e1', limit=10, added_after=\"01-01-2024\")\n",
        "print(json.dumps(poll_response, indent=4))"
      ]
    }
  ],
  "metadata": {
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "codemirror_mode": {
        "name": "ipython",
        "version": 3
      },
      "file_extension": ".py",
      "mimetype": "text/x-python",
      "name": "python",
      "nbconvert_exporter": "python",
      "pygments_lexer": "ipython3",
      "version": "3.9.5"
    },
    "colab": {
      "provenance": []
    }
  },
  "nbformat": 4,
  "nbformat_minor": 5
}