synapse.lib.stormlib package

Submodules

synapse.lib.stormlib.auth module

synapse.lib.stormlib.backup module

class synapse.lib.stormlib.backup.BackupLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the backup APIs in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.basex module

class synapse.lib.stormlib.basex.BaseXLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements helpers for encoding and decoding strings using an arbitrary charset.

async decode(text, charset)[source]
async encode(byts, charset)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.cell module

class synapse.lib.stormlib.cell.CellLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.cell.getMaxHotFixes()[source]

synapse.lib.stormlib.ethereum module

class synapse.lib.stormlib.ethereum.EthereumLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements helpers for Ethereum.

async eip55(addr)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.gen module

class synapse.lib.stormlib.gen.LibGen(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for secondary property based deconfliction.

synapse.lib.stormlib.hashes module

class synapse.lib.stormlib.hashes.LibHashes(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for hashing bytes

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.hashes.LibHmac(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for computing RFC2104 HMAC values.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.hex module

class synapse.lib.stormlib.hex.HexLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements helpers for hexadecimal encoded strings.

async decode(valu)[source]
async encode(valu)[source]
async fromint(valu, length, signed=False)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async signext(valu, length)[source]
async toint(valu, signed=False)[source]
async trimext(valu)[source]

synapse.lib.stormlib.imap module

class synapse.lib.stormlib.imap.ImapLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library to connect to an IMAP server.

async connect(host, port=993, timeout=30, ssl=True)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.imap.ImapServer(runt, imap_cli, path=None)[source]

Bases: synapse.lib.stormtypes.StormType

An IMAP server for retrieving email messages.

async delete(uid_set)[source]
async fetch(uid)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async list(reference_name='""', pattern='*')[source]
async login(user, passwd)[source]
async markSeen(uid_set)[source]
async search(*args)[source]
async select(mailbox='INBOX')[source]
async synapse.lib.stormlib.imap.run_imap_coro(coro)[source]

Raises or returns data.

synapse.lib.stormlib.infosec module

class synapse.lib.stormlib.infosec.CvssLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements CVSS score calculations.

async calculate(node, save=True, vers='3.1')[source]
async calculateFromProps(props, vers='3.1')[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async saveVectToNode(node, text)[source]
async vectToProps(text)[source]
synapse.lib.stormlib.infosec.roundup(x)[source]

synapse.lib.stormlib.ipv6 module

class synapse.lib.stormlib.ipv6.LibIpv6(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for providing ipv6 helpers.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.json module

class synapse.lib.stormlib.json.JsonLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Json data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.json.JsonSchema(runt, schema, use_default=True)[source]

Bases: synapse.lib.stormtypes.StormType

A JsonSchema validation object for use in validating data structures in Storm.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async stormrepr()[source]
synapse.lib.stormlib.json.compileJsSchema(schema, use_default=True)[source]
synapse.lib.stormlib.json.runJsSchema(schema, item, use_default=True)[source]

synapse.lib.stormlib.log module

class synapse.lib.stormlib.log.LoggerLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements server side logging. These messages are logged to the synapse.storm.log logger.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.macro module

class synapse.lib.stormlib.macro.LibMacro(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Storm Macros in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.macro.MacroExecCmd(runt, runtsafe)[source]

Bases: synapse.lib.storm.Cmd

Execute a named macro.

Example

inet:ipv4#cno.threat.t80 | macro.exec enrich_foo

async execStormCmd(runt, genr)[source]

Abstract base method

getArgParser()[source]
name = 'macro.exec'

synapse.lib.stormlib.math module

class synapse.lib.stormlib.math.MathLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for performing math operations.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.mime module

class synapse.lib.stormlib.mime.LibMimeHtml(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for manipulating HTML text.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async totext(html)[source]
synapse.lib.stormlib.mime.htmlToText(html)[source]

synapse.lib.stormlib.model module

class synapse.lib.stormlib.model.LibModel(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Data Model in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.LibModelDeprecated(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A storm library for interacting with the model deprecation mechanism.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.LibModelEdge(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with light edges and manipulating their key-value attributes.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

hivepath = ('cortex', 'model', 'edges')
validedgekeys = ('doc',)
class synapse.lib.stormlib.model.LibModelTags(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with tag specifications in the Cortex Data Model.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.ModelForm(form, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Form.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.ModelProp(prop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Property.

class synapse.lib.stormlib.model.ModelTagProp(tagprop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Tag Property.

class synapse.lib.stormlib.model.ModelType(valu, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

A Storm types wrapper around a lib.types.Type

synapse.lib.stormlib.modelext module

class synapse.lib.stormlib.modelext.LibModelExt(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for manipulating extended model elements.

async addForm(formname, basetype, typeopts, typeinfo)[source]
async addFormProp(formname, propname, typedef, propinfo)[source]
async addTagProp(propname, typedef, propinfo)[source]
async addUnivProp(propname, typedef, propinfo)[source]
async delForm(formname)[source]
async delFormProp(formname, propname)[source]
async delTagProp(propname)[source]
async delUnivProp(propname)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.notifications module

class synapse.lib.stormlib.notifications.NotifyLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for a user interacting with their notifications.

async get(indx)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async list(size=None)[source]

synapse.lib.stormlib.oauth module

class synapse.lib.stormlib.oauth.OAuthV1Client(runt, ckey, csecret, atoken, asecret, sigtype, path=None)[source]

Bases: synapse.lib.stormtypes.StormType

A client for doing OAuth Authentication from Storm.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.oauth.OAuthV1Lib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library to handle oauth v1 authentication.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.project module

class synapse.lib.stormlib.project.LibProjects(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Projects in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.Project(runt, node, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for Project objects, which are used for managing a scrum style project in the Cortex

confirm(perm)[source]
async nodes()[source]
value()[source]
class synapse.lib.stormlib.project.ProjectEpic(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectEpic

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectEpics(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectEpics objects, which are collections of ProjectEpic objects associated with a particular Project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectSprint(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectSprint

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectSprints(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectSprints objects, which are collections of sprints associated with a single project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectTicket(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicket.

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectTicketComment(ticket, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicketComment

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectTicketComments(ticket)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTicketComments objects, which are collections of comments associated with a ticket.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectTickets(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTickets objects, which are collections of tickets associated with a project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async iter()[source]

synapse.lib.stormlib.random module

class synapse.lib.stormlib.random.LibRandom(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for generating random values.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.scrape module

class synapse.lib.stormlib.scrape.LibScrape(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for providing helpers for scraping nodes from text.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.smtp module

class synapse.lib.stormlib.smtp.SmtpLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for sending email messages via SMTP.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async message()[source]
class synapse.lib.stormlib.smtp.SmtpMessage(runt)[source]

Bases: synapse.lib.stormtypes.StormType

An SMTP message to compose and send.

async send(host, port=25, user=None, passwd=None, usetls=False, starttls=False, timeout=60)[source]

synapse.lib.stormlib.stix module

class synapse.lib.stormlib.stix.LibStix(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Stix Version 2.1 CS02.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async liftBundle(bundle)[source]
async validateBundle(bundle)[source]
class synapse.lib.stormlib.stix.LibStixExport(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for exporting to STIX version 2.1 CS02.

async bundle(config=None)[source]
async config()[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

timestamp(tick)[source]
class synapse.lib.stormlib.stix.LibStixImport(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for importing Stix Version 2.1 data.

async config()[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async ingest(bundle, config=None)[source]
class synapse.lib.stormlib.stix.StixBundle(libstix, runt, config, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for creating and packing a STIX bundle for v2.1

async add(node, stixtype=None)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

pack()[source]
async value()[source]
synapse.lib.stormlib.stix.uuid4(valu=None)[source]
synapse.lib.stormlib.stix.uuid5(valu=None)[source]
synapse.lib.stormlib.stix.validateStix(bundle, version='2.1')[source]

synapse.lib.stormlib.storm module

class synapse.lib.stormlib.storm.LibStorm(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for evaluating dynamic storm expressions.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.version module

class synapse.lib.stormlib.version.VersionLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with version information.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async matches(vertup, reqstr)[source]

synapse.lib.stormlib.xml module

class synapse.lib.stormlib.xml.LibXml(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for parsing XML.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async parse(valu)[source]
class synapse.lib.stormlib.xml.XmlElement(runt, elem)[source]

Bases: synapse.lib.stormtypes.Prim

A Storm object for dealing with elements in an XML tree.

async find(name, nested=True)[source]
async get(name)[source]
async iter()[source]

synapse.lib.stormlib.yaml module

class synapse.lib.stormlib.yaml.LibYaml(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for saving/loading YAML data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Returns

A key/value pairs.

Return type

dict

async load(valu)[source]
async save(valu, sort_keys=True)[source]