synapse.lib.stormlib package

Submodules

synapse.lib.stormlib.auth module

synapse.lib.stormlib.backup module

class synapse.lib.stormlib.backup.BackupLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the backup APIs in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.cell module

class synapse.lib.stormlib.cell.CellLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Json data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.cell.getMaxHotFixes()[source]

synapse.lib.stormlib.hex module

class synapse.lib.stormlib.hex.HexLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements helpers for hexadecimal encoded strings.

async decode(valu)[source]
async encode(valu)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.imap module

class synapse.lib.stormlib.imap.ImapLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library to connect to an IMAP server.

async connect(host, port=993, timeout=30, ssl=True)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.imap.ImapServer(runt, imap_cli, path=None)[source]

Bases: synapse.lib.stormtypes.StormType

An IMAP server for retrieving email messages.

async delete(uid_set)[source]
async fetch(uid)[source]

IMAP fetch accepts a message set (e.g. “1”, “1:*”, “1,2,3”), however this method forces fetching a single uid to prevent retrieving a very large blob of data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async list(reference_name='""', pattern='*')[source]
async login(user, passwd)[source]
async markSeen(uid_set)[source]
async search(*args)[source]
async select(mailbox='INBOX')[source]
async synapse.lib.stormlib.imap.run_imap_coro(coro)[source]

Raises or returns data

synapse.lib.stormlib.infosec module

class synapse.lib.stormlib.infosec.CvssLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library which implements CVSS score calculations.

async calculate(node, save=True, vers='3.1')[source]
async calculateFromProps(props, vers='3.1')[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async saveVectToNode(node, text)[source]
async vectToProps(text)[source]
synapse.lib.stormlib.infosec.roundup(x)[source]

synapse.lib.stormlib.ipv6 module

class synapse.lib.stormlib.ipv6.LibIpv6(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for providing ipv6 helpers.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.json module

class synapse.lib.stormlib.json.JsonLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Json data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.json.JsonSchema(runt, schema)[source]

Bases: synapse.lib.stormtypes.StormType

A JsonSchema validation object for use in validating data structures in Storm.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async stormrepr()[source]
synapse.lib.stormlib.json.compileJsSchema(schema)[source]
synapse.lib.stormlib.json.runJsSchema(schema, item)[source]

synapse.lib.stormlib.macro module

class synapse.lib.stormlib.macro.LibMacro(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Storm Macros in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.macro.MacroExecCmd(runt, runtsafe)[source]

Bases: synapse.lib.storm.Cmd

Execute a named macro.

Example

inet:ipv4#cno.threat.t80 | macro.exec enrich_foo

async execStormCmd(runt, genr)[source]

Abstract base method

getArgParser()[source]
name = 'macro.exec'

synapse.lib.stormlib.model module

class synapse.lib.stormlib.model.LibModel(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with the Data Model in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.LibModelDeprecated(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A storm library for interacting with the model deprecation mechanism.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.LibModelEdge(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with light edges and manipulating their key-value attributes.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

hivepath = ('cortex', 'model', 'edges')
validedgekeys = ('doc',)
class synapse.lib.stormlib.model.LibModelTags(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with tag specifications in the Cortex Data Model.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.ModelForm(form, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Form.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.model.ModelProp(prop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Property.

class synapse.lib.stormlib.model.ModelTagProp(tagprop, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a Tag Property.

class synapse.lib.stormlib.model.ModelType(valu, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

A Storm types wrapper around a lib.types.Type

synapse.lib.stormlib.modelext module

class synapse.lib.stormlib.modelext.LibModelExt(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for manipulating extended model elements.

async addForm(formname, basetype, typeopts, typeinfo)[source]
async addFormProp(formname, propname, typedef, propinfo)[source]
async addTagProp(propname, typedef, propinfo)[source]
async addUnivProp(propname, typedef, propinfo)[source]
async delForm(formname)[source]
async delFormProp(formname, propname)[source]
async delTagProp(propname)[source]
async delUnivProp(propname)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.oauth module

class synapse.lib.stormlib.oauth.OAuthV1Client(runt, ckey, csecret, atoken, asecret, sigtype, path=None)[source]

Bases: synapse.lib.stormtypes.StormType

A client for doing OAuth Authentication from Storm

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

class synapse.lib.stormlib.oauth.OAuthV1Lib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library to handle oauth v1 authentication

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.project module

class synapse.lib.stormlib.project.LibProjects(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Projects in the Cortex.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.Project(runt, node, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for Project objects, which are used for managing a scrum style project in the Cortex

confirm(perm)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
value()[source]
class synapse.lib.stormlib.project.ProjectEpic(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectEpic

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectEpics(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectEpics objects, which are collections of ProjectEpic objects associated with a particular Project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectSprint(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectSprint

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectSprints(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectSprints objects, which are collections of sprints associated with a single project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectTicket(proj, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicket

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectTicketComment(ticket, node)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for a ProjectTicketComment

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async nodes()[source]
async value()[source]
class synapse.lib.stormlib.project.ProjectTicketComments(ticket)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTicketComments objects, which are collections of comments associated with a ticket.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async iter()[source]
class synapse.lib.stormlib.project.ProjectTickets(proj)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for ProjectTickets objects, which are collections of tickets associated with a project

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async iter()[source]

synapse.lib.stormlib.smtp module

class synapse.lib.stormlib.smtp.SmtpLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for sending email messages via SMTP.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async message()[source]
class synapse.lib.stormlib.smtp.SmtpMessage(runt)[source]

Bases: synapse.lib.stormtypes.StormType

An SMTP message to compose and send.

async send(host, port=25, user=None, passwd=None, usetls=False, starttls=False, timeout=60)[source]

synapse.lib.stormlib.stix module

class synapse.lib.stormlib.stix.LibStix(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with Stix Version 2.1 CS02.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async liftBundle(bundle)[source]
async validateBundle(bundle)[source]
class synapse.lib.stormlib.stix.LibStixExport(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for exporting to STIX version 2.1 CS02.

async bundle(config=None)[source]
async config()[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

timestamp(tick)[source]
class synapse.lib.stormlib.stix.StixBundle(libstix, runt, config, path=None)[source]

Bases: synapse.lib.stormtypes.Prim

Implements the Storm API for creating and packing a STIX bundle for v2.1

async add(node, stixtype=None)[source]
getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

pack()[source]
async value()[source]
synapse.lib.stormlib.stix.uuid4(valu=None)[source]
synapse.lib.stormlib.stix.uuid5(valu=None)[source]
synapse.lib.stormlib.stix.validateStix(bundle, version='2.1')[source]

synapse.lib.stormlib.storm module

class synapse.lib.stormlib.storm.LibStorm(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for evaluating dynamic storm expressions.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

synapse.lib.stormlib.version module

class synapse.lib.stormlib.version.VersionLib(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for interacting with version information.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async matches(vertup, reqstr)[source]

synapse.lib.stormlib.xml module

class synapse.lib.stormlib.xml.LibXml(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm library for parsing XML.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async parse(valu)[source]
class synapse.lib.stormlib.xml.XmlElement(runt, elem)[source]

Bases: synapse.lib.stormtypes.Prim

async find(name, nested=True)[source]
async get(name)[source]
async iter()[source]

synapse.lib.stormlib.yaml module

class synapse.lib.stormlib.yaml.LibYaml(runt, name=())[source]

Bases: synapse.lib.stormtypes.Lib

A Storm Library for saving/loading YAML data.

getObjLocals()[source]

Get the default list of key-value pairs which may be added to the object .locls dictionary.

Notes

These values are exposed in autodoc generated documentation.

Returns

A key/value pairs.

Return type

dict

async load(valu)[source]
async save(valu, sort_keys=True)[source]