freetaxii / libstix2

APIs for generating STIX 2.1 and TAXII 2.1 messages with Go (Golang)

FreeTAXII/libstix2

libstix2 an API for generating JSON based STIX objects and TAXII messages with the Go (Golang) programming language. Please see the examples directory and the README files in each of the sub packages for more information. This API is built to support STIX 2.x and TAXII 2.x.

Version

0.7.2

Installation

This package can be installed with the go get command:

go get github.com/freetaxii/libstix2

Special Thanks

I would like to thank the following contributors for there support of this project:

Oleksii Morozov

Dependencies

This software uses the following external libraries:

uuid
	go get github.com/pborman/uuid
	Copyright (c) 2014 Google Inc. All rights reserved. (Google License)

qo-sqlite3
	go get github.com/mattn/go-sqlite3
	go install github.com/mattn/go-sqlite3
	Copyright (c) 2014 Yasuhiro Matsumoto (MIT License)

This software uses the following builtin libraries:

crypto/sha1, database/sql, encoding/base64, errors, fmt, log, os, regexp, strings, testing, time
	Copyright 2009 The Go Authors

Features

Below is a list of major features and which ones have been implemented:

STIX Domain Objects

• Attack Pattern
• Campaign
• Course of Action
• Identity
• Indicator
• Intrusion Set
• Location
• Malware
• Note
• Observed Data
• Opinion
• Report
• Threat Actor
• Tool
• Vulnerability

STIX Relationship Objects

• Relationship
• Sighting

Other STIX Objects

• Bundle
• Language Content
• Marking Definition

TAXII Resources

• Discovery
• API Root
• Collections
• Collection
• Objects
• Manifest
• Envelope
• Status
• Error

Datastore

• SQLite 3

Naming Conventions

While Go does not require getters and setters, setters are used in libstix2 to enable validation and verification checks. All setters in libstix2 return an error type, even if they currently just return “nil”. This will ensure that the API will not change if/when additional validation / verification checks are added in the future.

Libstix2 uses the following naming conventions for methods on objects and resources.

• Methods that setup / create a new object have a name of "New" or "New"+ object type. These constructors return a pointer to the object.

• Methods that are setting a value have a name of “Set” + the property name. Example: “SetConfidence” is used for setting a value on the Confidence property.

• Methods that are getting a value have a name of “Get” + the property name. Example: “GetConfidence” is used for getting the value stored in the Confidence property.

• Methods that take in a value and add that value to a slice have a name of “Add” + the property name in the singular. Example: “AddLabel” is used to add a sting label to the labels property.

• Methods that take in an object and add that object to a slice have a name of “Add” + the object type in the singular. Example: “AddManifestEntry” is used to add a Manifest Entry to the Objects slice in the Manifest resource. It is important to note that these methods take in a pointer to the object instead of a copy of the object itself. Some examples with full signatures:

func (o *CollectionsType) AddCollection(o *CollectionType) (int, error) {}
func (o *ManifestType) AddManifestEntry(o *ManifestEntryType) (int, error) {}

• Methods that create a new object inside another object and return a pointer to a slice location for the new object have a name of “New” + the object type in the singular. Example: “NewManifestEntry” is used to create a new Manifest Entry in the Objects slice in the Manifest resource. Some examples with full signatures:

func (o *ExternalReferencesPropertyType) NewExternalReference() (*ExternalReferenceType, error) {}
func (o *KillChainPhasesPropertyType) NewKillChainPhase() (*KillChainPhaseType, error) {}
func (o *CollectionsType) NewCollection() (*CollectionType, error) {}
func (o *ManifestType) NewManifestEntry() (*ManifestEntryType, error) {}

• Methods that create and populate a new object in a single step have a name of “Create” + the object type in the singular. Example: “CreateManifestEntry” is used to create a new Manifest Entry in the Objects slice in the Manifest resource and populates it in one step. Some examples with full signatures:

func (o *KillChainPhasesPropertyType) CreateKillChainPhase(name, phase string) error {}
func (o *ManifestType) CreateManifestEntry(id, date, ver, media string) error {}

License

This is free software, licensed under the Apache License, Version 2.0. Read this for a summary.

Copyright

Copyright 2015-2022 Bret Jordan, All rights reserved.

libstix2's Issues

Add a bson tag in structures

I would like to use golang mongodb driver with this library, but it seems mongodb wont decode automatically to structure until bson tag in structure is defined.
Pattern string 'json:"pattern,omitempty"'
change to something like this
Pattern string 'json:"pattern,omitempty" bson:"pattern"'

Missing SCO implementations

It looks like libstix2 only implements a subset of the SCOs defined in the spec. Is this project still active?

[enhancement] Use unsigned integer

Thanks for the great project btw.

I would like to suggest use unsigned integer in libstix2.

For example, use uint as return type in properties/datastoreid.go.
I have never seen negative unique database ID since I started programming.

So, How would you go about using uint instead of int in this project?

Parse stix objects

Hello.I am looking for an alternative of https://github.com/oasis-open/cti-python-stix2. I was wondering if libstix2 provides the necessary functions to deserialize stix objects

Add support for custom objects

STIX 2.1 allows for custom objects. However, bundle.Decode() currently does not allow for them as the decoding of objects is hardcoded with a fallback to a generic object.STIXObject. Optimally, one can introduce custom STIX objects into a project and provide a type to DecodeFunc mapping which in turn bundle.Decode() uses to decode custom objects in a STIX bundle.