synapse.lib.stormlib package

Submodules

synapse.lib.stormlib.aha module

class synapse.lib.stormlib.aha.AhaLib(runt, name=())

Bases: Lib

A Storm Library for interacting with AHA.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.aha.AhaPool(runt, poolinfo)

Bases: StormType

Implements the Storm API for an AHA pool.

async stormrepr()

class synapse.lib.stormlib.aha.AhaPoolLib(runt, name=())

Bases: Lib

A Storm Library for interacting with AHA service pools.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.auth module

class synapse.lib.stormlib.auth.Gate(runt, valu, path=None)

Bases: Prim

Implements the Storm API for an AuthGate.

class synapse.lib.stormlib.auth.LibAuth(runt, name=())

Bases: Lib

A Storm Library for interacting with Auth in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async getPermDef(perm)

async getPermDefs()

static ruleFromText(text)

async textFromRule(rule)

class synapse.lib.stormlib.auth.LibGates(runt, name=())

Bases: Lib

A Storm Library for interacting with Auth Gates in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.auth.LibRoles(runt, name=())

Bases: Lib

A Storm Library for interacting with Auth Roles in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.auth.LibUser(runt, name=())

Bases: Lib

A Storm Library for interacting with data about the current user.

addLibFuncs()

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.auth.LibUsers(runt, name=())

Bases: Lib

A Storm Library for interacting with Auth Users in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.auth.Role(runt, valu, path=None)

Bases: Prim

Implements the Storm API for a Role.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

async value()

class synapse.lib.stormlib.auth.StormUserProfileDict(runt, valu, path=None)

Bases: Prim

A Storm Primitive that maps the HiveDict interface to a user profile dictionary.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

async value()

class synapse.lib.stormlib.auth.StormUserVarsDict(runt, valu, path=None)

Bases: Prim

A Storm Primitive that maps the HiveDict interface to a user vars dictionary.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

async value()

class synapse.lib.stormlib.auth.User(runt, valu, path=None)

Bases: Prim

Implements the Storm API for a User.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

async value()

class synapse.lib.stormlib.auth.UserJson(runt, valu)

Bases: Prim

Implements per-user JSON storage.

async get(path, prop=None)

async has(path)

async iter(path=None)

async set(path, valu, prop=None)

class synapse.lib.stormlib.auth.UserProfile(runt, valu, path=None)

Bases: Prim

The Storm deref/setitem/iter convention on top of User profile information.

async deref(name)

async iter()

async setitem(name, valu)

async value()

class synapse.lib.stormlib.auth.UserVars(runt, valu, path=None)

Bases: Prim

The Storm deref/setitem/iter convention on top of User vars information.

async deref(name)

async iter()

async setitem(name, valu)

synapse.lib.stormlib.auth.ruleFromText(text)

Get a rule tuple from a text string.

Parameters:

text (str) – The string to process.

Returns:

A tuple containing a bool and a list of permission parts.

Return type:

(bool, tuple)

synapse.lib.stormlib.backup module

class synapse.lib.stormlib.backup.BackupLib(runt, name=())

Bases: Lib

A Storm Library for interacting with the backup APIs in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.basex module

class synapse.lib.stormlib.basex.BaseXLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for encoding and decoding strings using an arbitrary charset.

async decode(text, charset)

async encode(byts, charset)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.cache module

class synapse.lib.stormlib.cache.FixedCache(runt, query, size=10000)

Bases: StormType

A StormLib API instance of a Storm Fixed Cache.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

class synapse.lib.stormlib.cache.LibCache(runt, name=())

Bases: Lib

A Storm Library for interacting with Cache Objects.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.cell module

class synapse.lib.stormlib.cell.CellLib(runt, name=())

Bases: Lib

A Storm Library for interacting with the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.cell.getMaxHotFixes()

synapse.lib.stormlib.cell.prepHotfixDesc(txt)

synapse.lib.stormlib.compression module

class synapse.lib.stormlib.compression.Bzip2Lib(runt, name=())

Bases: Lib

A Storm library which implements helpers for bzip2 compression.

async en(valu)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async un(valu)

class synapse.lib.stormlib.compression.GzipLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for gzip compression.

async en(valu)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async un(valu)

class synapse.lib.stormlib.compression.ZlibLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for zlib compression.

async en(valu)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async un(valu)

synapse.lib.stormlib.cortex module

class synapse.lib.stormlib.cortex.CortexHttpApi(runt, name=())

Bases: Lib

Library for interacting with the Extended HTTP API.

async addHttpApi(path, name='', desc='', runas='owner', authenticated=True, readonly=False, iden=None)

async delHttpApi(iden)

async getHttpApi(iden)

async getHttpApiByPath(path)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async listHttpApis()

async makeHttpResponse(requestinfo)

async setHttpApiIndx(iden, index=0)

class synapse.lib.stormlib.cortex.HttpApi(runt, info)

Bases: StormType

Extended HTTP API object.

This object represents an extended HTTP API that has been configured on the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

class synapse.lib.stormlib.cortex.HttpApiMethods(httpapi: HttpApi)

Bases: Prim

Accessor dictionary for getting and setting Extended HTTP API methods.

Notes:

The Storm code used to run these methods will have a $request object injected into them. This allows the method to send data back to the caller when it is run.

Examples:

Setting a simple GET method:

$api.methods.get = ${
    $data = ({"someKey": "someValue})
    $headers = ({"someHeader": "someOtherValue"})
    $request.reply(200, headers=$headers, body=$data)
}

Removing a PUT method:

$api.methods.put = $lib.undef

Crafting a custom text response:

$api.methods.get = ${
    // Create the body
    $data = 'some value'
    // Encode the response as bytes
    $data = $data.encode()
    // Set the headers
    $headers = ({"Content-Type": "text/plain", "Content-Length": $lib.len($data})
    $request.reply(200, headers=$headers, body=$data)
}

Streaming multiple chunks of data as JSON lines. This sends the code, headers and body separately:

$api.methods.get = ${
    $request.sendcode(200)
    $request.sendheaders(({"Content-Type": "text/plain; charset=utf8"}))
    $values = ((1), (2), (3))
    for $i in $values {
        $body=`{$lib.json.save(({"value": $i}))}

`

$request.sendbody($body.encode())

}

}

async iter()

class synapse.lib.stormlib.cortex.HttpApiVars(httpapi, path=None)

Bases: Dict

Accessor dictionary for getting and setting Extended HTTP API variables.

This can be used to set, unset or iterate over the runtime variables that are set for an Extended HTTP API endpoint. These variables are set in the Storm runtime for all of the HTTP methods configured to be executed by the endpoint.

Example

Set a few variables on a given API:

$api.vars.foo = 'the foo string'
$api.vars.bar = (1234)

Remove a variable:

$api.vars.foo = $lib.undef

Iterate over the variables set for the endpoint:

for ($key, $valu) in $api.vars {
    $lib.print(`{$key) -> {$valu}`)
}

Overwrite all of the variables for a given API with a new dictionary:

$api.vars = ({"foo": "a new string", "bar": (137)})

async setitem(name, valu)

class synapse.lib.stormlib.cortex.HttpHeaderDict(valu, path=None)

Bases: Dict

Immutable lowercase key access dictionary for HTTP request headers.

Example

Request headers can be accessed in a case insensitive manner:

$valu = $request.headers.Cookie
// or the lower case value
$valu = $request.headers.cookie

async deref(name)

async setitem(name, valu)

class synapse.lib.stormlib.cortex.HttpPermsList(httpapi, path=None)

Bases: List

Accessor list for getting and setting http:api permissions.

async setitem(name, valu)

class synapse.lib.stormlib.cortex.HttpReq(runt, rnfo)

Bases: StormType

Extended HTTP API Request object.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.cortex.StormPoolDelCmd(runt, runtsafe)

Bases: Cmd

Remove a Storm query offload mirror pool configuration.

Notes

This will result in tearing down any Storm queries currently being serviced by the Storm pool. This may result in this command raising an exception if it was offloaded to a pool member. That would be an expected behavior.

async execStormCmd(runt, genr)

Abstract base method

name = 'cortex.storm.pool.del'

class synapse.lib.stormlib.cortex.StormPoolGetCmd(runt, runtsafe)

Bases: Cmd

Display the current Storm query offload mirror pool configuration.

async execStormCmd(runt, genr)

Abstract base method

name = 'cortex.storm.pool.get'

class synapse.lib.stormlib.cortex.StormPoolSetCmd(runt, runtsafe)

Bases: Cmd

Setup a Storm query offload mirror pool for the Cortex.

async execStormCmd(runt, genr)

Abstract base method

getArgParser()

name = 'cortex.storm.pool.set'

synapse.lib.stormlib.easyperm module

class synapse.lib.stormlib.easyperm.LibEasyPerm(runt, name=())

Bases: Lib

A Storm Library for interacting with easy perm dictionaries.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.env module

class synapse.lib.stormlib.env.LibEnv(runt, name=())

Bases: Lib

A Storm Library for accessing environment vars.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.ethereum module

class synapse.lib.stormlib.ethereum.EthereumLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for Ethereum.

async eip55(addr)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.gen module

class synapse.lib.stormlib.gen.LibGen(runt, name=())

Bases: Lib

A Storm Library for secondary property based deconfliction.

synapse.lib.stormlib.gis module

class synapse.lib.stormlib.gis.GisLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for earth based geospatial calculations.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.graph module

class synapse.lib.stormlib.graph.GraphLib(runt, name=())

Bases: Lib

A Storm Library for interacting with graph projections in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.hashes module

class synapse.lib.stormlib.hashes.LibHashes(runt, name=())

Bases: Lib

A Storm Library for hashing bytes

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.hashes.LibHmac(runt, name=())

Bases: Lib

A Storm library for computing RFC2104 HMAC values.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.hex module

class synapse.lib.stormlib.hex.HexLib(runt, name=())

Bases: Lib

A Storm library which implements helpers for hexadecimal encoded strings.

async decode(valu)

async encode(valu)

async fromint(valu, length, signed=False)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async signext(valu, length)

async toint(valu, signed=False)

async trimext(valu)

synapse.lib.stormlib.imap module

class synapse.lib.stormlib.imap.ImapLib(runt, name=())

Bases: Lib

A Storm library to connect to an IMAP server.

async connect(host, port=993, timeout=30, ssl=True, ssl_verify=True)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.imap.ImapServer(runt, imap_cli, path=None)

Bases: StormType

An IMAP server for retrieving email messages.

async delete(uid_set)

async fetch(uid)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async list(reference_name='""', pattern='*')

async login(user, passwd)

async markSeen(uid_set)

async search(*args, charset='utf-8')

async select(mailbox='INBOX')

async synapse.lib.stormlib.imap.run_imap_coro(coro)

Raises or returns data.

synapse.lib.stormlib.infosec module

synapse.lib.stormlib.infosec.CVSS2_calc(vdict)

synapse.lib.stormlib.infosec.CVSS2_round(x)

synapse.lib.stormlib.infosec.CVSS3_0_calc(vdict)

synapse.lib.stormlib.infosec.CVSS3_0_round(x)

Round up to the nearest one decimal place. From the JS reference implementation: https://www.first.org/cvss/calculator/cvsscalc30.js

synapse.lib.stormlib.infosec.CVSS3_1_calc(vdict)

synapse.lib.stormlib.infosec.CVSS3_1_round(x)

Round up to the nearest one decimal place. From the JS reference implementation: https://www.first.org/cvss/calculator/cvsscalc31.js

synapse.lib.stormlib.infosec.CVSS_get_coefficients(vdict, vers)

class synapse.lib.stormlib.infosec.CvssLib(runt, name=())

Bases: Lib

A Storm library which implements CVSS score calculations.

async calculate(node, save=True, vers='3.1')

async calculateFromProps(props, vers='3.1')

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async saveVectToNode(node, text)

async vectToProps(text)

async vectToScore(vect, vers=None)

class synapse.lib.stormlib.infosec.MitreAttackFlowLib(runt, name=())

Bases: Lib

A Storm library which implements modeling MITRE ATT&CK Flow diagrams.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.infosec.roundup(x)

synapse.lib.stormlib.ipv6 module

class synapse.lib.stormlib.ipv6.LibIpv6(runt, name=())

Bases: Lib

A Storm Library for providing ipv6 helpers.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.iters module

class synapse.lib.stormlib.iters.LibIters(runt, name=())

Bases: Lib

A Storm library for providing iterator helpers.

async enum(genr)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.json module

class synapse.lib.stormlib.json.JsonLib(runt, name=())

Bases: Lib

A Storm Library for interacting with Json data.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.json.JsonSchema(runt, schema, use_default=True)

Bases: StormType

A JsonSchema validation object for use in validating data structures in Storm.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

synapse.lib.stormlib.json.compileJsSchema(schema, use_default=True)

synapse.lib.stormlib.json.runJsSchema(schema, item, use_default=True)

synapse.lib.stormlib.log module

class synapse.lib.stormlib.log.LoggerLib(runt, name=())

Bases: Lib

A Storm library which implements server side logging. These messages are logged to the synapse.storm.log logger.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.macro module

class synapse.lib.stormlib.macro.LibMacro(runt, name=())

Bases: Lib

A Storm Library for interacting with the Storm Macros in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.macro.MacroExecCmd(runt, runtsafe)

Bases: Cmd

Execute a named macro.

Example

inet:ipv4#cno.threat.t80 | macro.exec enrich_foo

async execStormCmd(runt, genr)

Abstract base method

getArgParser()

name = 'macro.exec'

readonly = True

synapse.lib.stormlib.math module

class synapse.lib.stormlib.math.MathLib(runt, name=())

Bases: Lib

A Storm library for performing math operations.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.mime module

class synapse.lib.stormlib.mime.LibMimeHtml(runt, name=())

Bases: Lib

A Storm library for manipulating HTML text.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async totext(html)

synapse.lib.stormlib.mime.htmlToText(html)

synapse.lib.stormlib.model module

class synapse.lib.stormlib.model.LibModel(runt, name=())

Bases: Lib

A Storm Library for interacting with the Data Model in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.LibModelDeprecated(runt, name=())

Bases: Lib

A storm library for interacting with the model deprecation mechanism.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.LibModelEdge(runt, name=())

Bases: Lib

A Storm Library for interacting with light edges and manipulating their key-value attributes. This Library is deprecated.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

hivepath = ('cortex', 'model', 'edges')

validedgekeys = ('doc',)

class synapse.lib.stormlib.model.LibModelMigration(runt, name=())

Bases: Lib, MigrationEditorMixin

A Storm library containing migration tools.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.LibModelMigrations(runt, name=())

Bases: Lib, MigrationEditorMixin

A Storm library for selectively migrating nodes in the current view.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.LibModelMigrations_0_2_31(runt, name=())

Bases: Lib

A Storm library with helper functions for the 0.2.31 model it:sec:cpe migration.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.LibModelTags(runt, name=())

Bases: Lib

A Storm Library for interacting with tag specifications in the Cortex Data Model.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.model.MigrationEditorMixin

Bases: object

Mixin helpers for migrating data within an editor context.

async copyData(src, proto, overwrite=False)

async copyEdges(editor, src, proto)

async copyExtProps(src, proto)

async copyTags(src, proto, overwrite=False)

class synapse.lib.stormlib.model.ModelForm(form, path=None)

Bases: Prim

Implements the Storm API for a Form.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

value()

class synapse.lib.stormlib.model.ModelProp(prop, path=None)

Bases: Prim

Implements the Storm API for a Property.

value()

class synapse.lib.stormlib.model.ModelTagProp(tagprop, path=None)

Bases: Prim

Implements the Storm API for a Tag Property.

value()

class synapse.lib.stormlib.model.ModelType(valu, path=None)

Bases: Prim

A Storm types wrapper around a lib.types.Type

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

value()

synapse.lib.stormlib.modelext module

class synapse.lib.stormlib.modelext.LibModelExt(runt, name=())

Bases: Lib

A Storm library for manipulating extended model elements.

async addEdge(n1form, verb, n2form, edgeinfo)

async addExtModel(model)

async addForm(formname, basetype, typeopts, typeinfo)

async addFormProp(formname, propname, typedef, propinfo)

async addTagProp(propname, typedef, propinfo)

async addType(typename, basetype, typeopts, typeinfo)

async addUnivProp(propname, typedef, propinfo)

async delEdge(n1form, verb, n2form)

async delForm(formname)

async delFormProp(formname, propname, force=False)

async delTagProp(propname, force=False)

async delType(typename)

async delUnivProp(propname, force=False)

async getExtModel()

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.notifications module

class synapse.lib.stormlib.notifications.NotifyLib(runt, name=())

Bases: Lib

A Storm library for a user interacting with their notifications.

async get(indx)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async list(size=None)

synapse.lib.stormlib.oauth module

class synapse.lib.stormlib.oauth.OAuthV1Client(runt, ckey, csecret, atoken, asecret, sigtype, path=None)

Bases: StormType

A client for doing OAuth V1 Authentication from Storm.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.oauth.OAuthV1Lib(runt, name=())

Bases: Lib

A Storm library to handle OAuth v1 authentication.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.oauth.OAuthV2Lib(runt, name=())

Bases: Lib

A Storm library for managing OAuth V2 clients.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.pack module

class synapse.lib.stormlib.pack.LibPack(runt, name=())

Bases: Lib

Packing / unpacking structured bytes.

async en(fmt, items)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async un(fmt, byts, offs=0)

synapse.lib.stormlib.project module

class synapse.lib.stormlib.project.LibProjects(runt, name=())

Bases: Lib

A Storm Library for interacting with Projects in the Cortex.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

class synapse.lib.stormlib.project.Project(runt, node, path=None)

Bases: Prim

Implements the Storm API for Project objects, which are used for managing a scrum style project in the Cortex

confirm(perm)

async nodes()

value()

class synapse.lib.stormlib.project.ProjectEpic(proj, node)

Bases: Prim

Implements the Storm API for a ProjectEpic

async nodes()

async value()

class synapse.lib.stormlib.project.ProjectEpics(proj)

Bases: Prim

Implements the Storm API for ProjectEpics objects, which are collections of ProjectEpic objects associated with a particular Project

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

class synapse.lib.stormlib.project.ProjectSprint(proj, node)

Bases: Prim

Implements the Storm API for a ProjectSprint

async nodes()

async value()

class synapse.lib.stormlib.project.ProjectSprints(proj)

Bases: Prim

Implements the Storm API for ProjectSprints objects, which are collections of sprints associated with a single project

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

class synapse.lib.stormlib.project.ProjectTicket(proj, node)

Bases: Prim

Implements the Storm API for a ProjectTicket.

async nodes()

async value()

class synapse.lib.stormlib.project.ProjectTicketComment(ticket, node)

Bases: Prim

Implements the Storm API for a ProjectTicketComment

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async nodes()

async value()

class synapse.lib.stormlib.project.ProjectTicketComments(ticket)

Bases: Prim

Implements the Storm API for ProjectTicketComments objects, which are collections of comments associated with a ticket.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

class synapse.lib.stormlib.project.ProjectTickets(proj)

Bases: Prim

Implements the Storm API for ProjectTickets objects, which are collections of tickets associated with a project

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async iter()

synapse.lib.stormlib.random module

class synapse.lib.stormlib.random.LibRandom(runt, name=())

Bases: Lib

A Storm library for generating random values.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.random.Random(runt, seed: str | None = None)

Bases: StormType

A random number generator.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

synapse.lib.stormlib.scrape module

class synapse.lib.stormlib.scrape.LibScrape(runt, name=())

Bases: Lib

A Storm Library for providing helpers for scraping nodes from text.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

synapse.lib.stormlib.smtp module

class synapse.lib.stormlib.smtp.SmtpLib(runt, name=())

Bases: Lib

A Storm Library for sending email messages via SMTP.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async message()

class synapse.lib.stormlib.smtp.SmtpMessage(runt)

Bases: StormType

An SMTP message to compose and send.

async send(host, port=25, user=None, passwd=None, usetls=False, starttls=False, timeout=60, ssl_verify=True)

synapse.lib.stormlib.spooled module

class synapse.lib.stormlib.spooled.LibSpooled(runt, name=())

Bases: Lib

A Storm Library for interacting with Spooled Objects.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.spooled.SpooledSet(valu, path=None)

Bases: Set

A StormLib API instance of a Storm Set object that can fallback to lmdb.

async iter()

async stormrepr()

async value()

synapse.lib.stormlib.stats module

class synapse.lib.stormlib.stats.LibStats(runt, name=())

Bases: Lib

A Storm Library for statistics related functionality.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async tally()

class synapse.lib.stormlib.stats.StatTally(path=None)

Bases: Prim

A tally object.

An example of using it:

$tally = $lib.stats.tally()

$tally.inc(foo)

for $name, $total in $tally {
    $doStuff($name, $total)
}

async get(name)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async inc(name, valu=1)

async iter()

async sorted(byname=False, reverse=False)

value()

class synapse.lib.stormlib.stats.StatsCountByCmd(runt, runtsafe)

Bases: Cmd

Tally occurrences of values and display a bar chart of the results.

Examples

// Show counts of geo:name values referenced by media:news nodes. media:news -(refs)> geo:name | stats.countby

// Show counts of ASN values in a set of IPs. inet:ipv4#myips | stats.countby :asn

// Show counts of attacker names for risk:compromise nodes. risk:compromise | stats.countby :attacker::name

async execStormCmd(runt, genr)

Abstract base method

getArgParser()

name = 'stats.countby'

readonly = True

synapse.lib.stormlib.stix module

class synapse.lib.stormlib.stix.LibStix(runt, name=())

Bases: Lib

A Storm Library for interacting with Stix Version 2.1 CS02.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async liftBundle(bundle)

async validateBundle(bundle)

class synapse.lib.stormlib.stix.LibStixExport(runt, name=())

Bases: Lib

A Storm Library for exporting to STIX version 2.1 CS02.

async bundle(config=None)

async config()

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

timestamp(tick)

class synapse.lib.stormlib.stix.LibStixImport(runt, name=())

Bases: Lib

A Storm Library for importing Stix Version 2.1 data.

async config()

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async ingest(bundle, config=None)

class synapse.lib.stormlib.stix.StixBundle(libstix, runt, config, path=None)

Bases: Prim

Implements the Storm API for creating and packing a STIX bundle for v2.1

async add(node, stixtype=None)

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

pack()

size()

async value()

synapse.lib.stormlib.stix.uuid4(valu=None)

synapse.lib.stormlib.stix.uuid5(valu=None)

synapse.lib.stormlib.stix.validateStix(bundle, version='2.1')

synapse.lib.stormlib.storm module

class synapse.lib.stormlib.storm.LibStorm(runt, name=())

Bases: Lib

A Storm library for evaluating dynamic storm expressions.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.storm.StormExecCmd(runt, runtsafe)

Bases: Cmd

Execute text or an embedded query object as Storm in the current pipeline.

NOTE: It is recommended to avoid using this where possible to avoid potential query injection risks. If you must use this, take care to ensure any values being executed have been properly sanitized.

Examples

// Add nodes using text in a variable $query = ‘[ inet:fqdn=foo.com inet:fqdn=bar.net ]’ storm.exec $query

// Filter nodes in the pipeline using text in a variable $filter = ‘-:asn=10’ inet:ipv4:asn storm.exec $filter

// Pivot using an embedded query $pivot = ${ -> inet:asn } inet:ipv4:asn storm.exec $pivot

async execStormCmd(runt, genr)

Abstract base method

getArgParser()

name = 'storm.exec'

synapse.lib.stormlib.tabular module

class synapse.lib.stormlib.tabular.LibTabular(runt, name=())

Bases: Lib

A Storm Library for creating printable tables.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.tabular.TabularPrinter(runt, conf)

Bases: StormType

A Storm object for printing tabular data using a defined configuration.

async header()

async row(data)

synapse.lib.stormlib.vault module

class synapse.lib.stormlib.vault.LibVault(runt, name=())

Bases: Lib

A Storm Library for interacting with vaults.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

class synapse.lib.stormlib.vault.Vault(runt, valu, path=None)

Bases: Prim

Implements the Storm API for a Vault.

Callers (instantiation) of this class must have already checked that the user has at least PERM_READ to the vault.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async stormrepr()

value()

class synapse.lib.stormlib.vault.VaultConfigs(runt, valu, path=None)

Bases: Prim

Implements the Storm API for Vault data. This is used for both vault configs and vault secrets.

async deref(name)

async iter()

async setitem(name, valu)

async stormrepr()

value()

class synapse.lib.stormlib.vault.VaultSecrets(runt, valu, path=None)

Bases: VaultConfigs

async setitem(name, valu)

synapse.lib.stormlib.version module

class synapse.lib.stormlib.version.VersionLib(runt, name=())

Bases: Lib

A Storm Library for interacting with version information.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async matches(vertup, reqstr)

synapse.lib.stormlib.xml module

class synapse.lib.stormlib.xml.LibXml(runt, name=())

Bases: Lib

A Storm library for parsing XML.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async parse(valu)

class synapse.lib.stormlib.xml.XmlElement(runt, elem)

Bases: Prim

A Storm object for dealing with elements in an XML tree.

async find(name, nested=True)

async get(name)

async iter()

synapse.lib.stormlib.yaml module

class synapse.lib.stormlib.yaml.LibYaml(runt, name=())

Bases: Lib

A Storm Library for saving/loading YAML data.

getObjLocals()

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns:

A key/value pairs.

Return type:

dict

async load(valu)

async save(valu, sort_keys=True)