synapse.lib.stormlib package

Submodules

synapse.lib.stormlib.auth module

synapse.lib.stormlib.backup module

class synapse.lib.stormlib.backup.BackupLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the backup APIs in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict

synapse.lib.stormlib.cell module

class synapse.lib.stormlib.cell.CellLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Json data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
synapse.lib.stormlib.cell.getMaxHotFixes()[source]

synapse.lib.stormlib.imap module

class synapse.lib.stormlib.imap.ImapLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library to connect to an IMAP server.

connect(host, port=993, timeout=30, ssl=True)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.imap.ImapServer(runt, imap_cli, path=None)[source]

Bases: synapse.lib.stormtypes.StormType

An IMAP server for retrieving email messages.

delete(uid_set)[source]
fetch(uid)[source]

IMAP fetch accepts a message set (e.g. “1”, “1:*”, “1,2,3”), however this method forces fetching a single uid to prevent retrieving a very large blob of data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
list(reference_name='""', pattern='*')[source]
login(user, passwd)[source]
markSeen(uid_set)[source]
search(*args)[source]
select(mailbox='INBOX')[source]
synapse.lib.stormlib.imap.run_imap_coro(coro)[source]

Raises or returns data

synapse.lib.stormlib.infosec module

class synapse.lib.stormlib.infosec.CvssLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements CVSS score calculations.

calculate(node, save=True, vers='3.1')[source]
calculateFromProps(props, vers='3.1')[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
saveVectToNode(node, text)[source]
vectToProps(text)[source]
synapse.lib.stormlib.infosec.roundup(x)[source]

synapse.lib.stormlib.json module

class synapse.lib.stormlib.json.JsonLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Json data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict

synapse.lib.stormlib.macro module

class synapse.lib.stormlib.macro.LibMacro(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Storm Macros in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.macro.MacroExecCmd(runt, runtsafe)[source]

Bases: synapse.lib.storm.Cmd

Execute a named macro.

Example

inet:ipv4#cno.threat.t80 | macro.exec enrich_foo

execStormCmd(runt, genr)[source]

Abstract base method

getArgParser()[source]
name = 'macro.exec'

synapse.lib.stormlib.model module

class synapse.lib.stormlib.model.LibModel(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Data Model in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.model.LibModelDeprecated(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A storm library for interacting with the model deprecation mechanism.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.model.LibModelEdge(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with light edges and manipulating their key-value attributes.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
hivepath = ('cortex', 'model', 'edges')
validedgekeys = ('doc',)
class synapse.lib.stormlib.model.LibModelTags(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with tag specifications in the Cortex Data Model.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.model.ModelForm(form, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Form.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
class synapse.lib.stormlib.model.ModelProp(prop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Property.

class synapse.lib.stormlib.model.ModelTagProp(tagprop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Tag Property.

class synapse.lib.stormlib.model.ModelType(valu, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

A Storm types wrapper around a lib.types.Type

synapse.lib.stormlib.modelext module

class synapse.lib.stormlib.modelext.LibModelExt(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for manipulating extended model elements.

addForm(formname, basetype, typeopts, typeinfo)[source]
addFormProp(formname, propname, typedef, propinfo)[source]
addTagProp(propname, typedef, propinfo)[source]
addUnivProp(propname, typedef, propinfo)[source]
delForm(formname)[source]
delFormProp(formname, propname)[source]
delTagProp(propname)[source]
delUnivProp(propname)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict

synapse.lib.stormlib.project module

class synapse.lib.stormlib.project.LibProjects(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Projects in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
iter()[source]
class synapse.lib.stormlib.project.Project(runt, node, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for Project objects, which are used for managing a scrum style project in the Cortex

confirm(perm)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
value()[source]
class synapse.lib.stormlib.project.ProjectEpic(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectEpic

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
value()[source]
class synapse.lib.stormlib.project.ProjectEpics(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectEpics objects, which are collections of ProjectEpic objects associated with a particular Project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
iter()[source]
class synapse.lib.stormlib.project.ProjectSprint(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectSprint

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
value()[source]
class synapse.lib.stormlib.project.ProjectSprints(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectSprints objects, which are collections of sprints associated with a single project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
iter()[source]
class synapse.lib.stormlib.project.ProjectTicket(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicket

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
value()[source]
class synapse.lib.stormlib.project.ProjectTicketComment(ticket, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicketComment

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
value()[source]
class synapse.lib.stormlib.project.ProjectTicketComments(ticket)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTicketComments objects, which are collections of comments associated with a ticket.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
iter()[source]
class synapse.lib.stormlib.project.ProjectTickets(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTickets objects, which are collections of tickets associated with a project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
iter()[source]

synapse.lib.stormlib.smtp module

class synapse.lib.stormlib.smtp.SmtpLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for sending email messages via SMTP.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
message()[source]
class synapse.lib.stormlib.smtp.SmtpMessage(runt)[source]

Bases: synapse.lib.stormtypes.StormType

An SMTP message to compose and send.

send(host, port=25, user=None, passwd=None, usetls=False, starttls=False, timeout=60)[source]

synapse.lib.stormlib.stix module

class synapse.lib.stormlib.stix.LibStix(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Stix Version 2.1 CS02.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
liftBundle(bundle)[source]
validateBundle(bundle)[source]
class synapse.lib.stormlib.stix.LibStixExport(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for exporting to STIX version 2.1 CS02.

bundle(config=None)[source]
config()[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
timestamp(tick)[source]
class synapse.lib.stormlib.stix.StixBundle(libstix, runt, config, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for creating and packing a STIX bundle for v2.1

add(node, stixtype=None)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
pack()[source]
value()[source]
synapse.lib.stormlib.stix.uuid4(valu=None)[source]
synapse.lib.stormlib.stix.uuid5(valu=None)[source]
synapse.lib.stormlib.stix.validateStix(bundle, version='2.1')[source]

synapse.lib.stormlib.storm module

class synapse.lib.stormlib.storm.LibStorm(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for evaluating dynamic storm expressions.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict

synapse.lib.stormlib.version module

class synapse.lib.stormlib.version.VersionLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with version information.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns:A key/value pairs.
Return type:dict
matches(vertup, reqstr)[source]