synapse.models package

This is called for modules after getModelDefs() and getStormCmds() has been called, in order to allow for model loading and storm command loading prior to code execution offered by initCoreModule.

A failure during initCoreModule will not unload data model or storm commands registered by the module.

Returns: None

class synapse.models.files.FilePath(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

synapse.models.geopol module

class synapse.models.geopol.PolModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.geospace module

class synapse.models.geospace.Area(modl, name, info, opts)[source]

Bases: synapse.lib.types.Int

postTypeInit()[source]

repr(norm)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

class synapse.models.geospace.Dist(modl, name, info, opts)[source]

Bases: synapse.lib.types.Int

postTypeInit()[source]

repr(norm)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

class synapse.models.geospace.GeoModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

class synapse.models.geospace.LatLong(modl, name, info, opts)[source]

Bases: synapse.lib.types.Type

postTypeInit()[source]

repr(norm)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

stortype: int = 14

synapse.models.inet module

class synapse.models.inet.Addr(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

class synapse.models.inet.Cidr4(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

class synapse.models.inet.Cidr6(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

class synapse.models.inet.Email(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

class synapse.models.inet.Fqdn(modl, name, info, opts)[source]

Bases: synapse.lib.types.Type

postTypeInit()[source]

repr(valu)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

stortype: int = 17

class synapse.models.inet.HttpCookie(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

getTypeVals(valu)[source]

class synapse.models.inet.IPv4(modl, name, info, opts)[source]

Bases: synapse.lib.types.Type

The base type for an IPv4 address.

getCidrRange(text)[source]

getNetRange(text)[source]

getTypeVals(valu)[source]

postTypeInit()[source]

repr(norm)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

stortype: int = 4

class synapse.models.inet.IPv4Range(modl, name, info, opts)[source]

Bases: synapse.lib.types.Range

postTypeInit()[source]

class synapse.models.inet.IPv6(modl, name, info, opts)[source]

Bases: synapse.lib.types.Type

getCidrRange(text)[source]

getNetRange(text)[source]

getTypeVals(valu)[source]

postTypeInit()[source]

stortype: int = 18

class synapse.models.inet.IPv6Range(modl, name, info, opts)[source]

Bases: synapse.lib.types.Range

postTypeInit()[source]

class synapse.models.inet.InetModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

async initCoreModule()[source]

Module implementers may override this method to initialize the module after the Cortex has completed and is accessible to perform storage operations.

Notes

This is the preferred function to override for implementing custom code that needs to be executed during Cortex startup.

Any exception raised within this method will remove the module from the list of currently loaded modules.

This is called for modules after getModelDefs() and getStormCmds() has been called, in order to allow for model loading and storm command loading prior to code execution offered by initCoreModule.

A failure during initCoreModule will not unload data model or storm commands registered by the module.

Returns: None

class synapse.models.inet.Rfc2822Addr(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

An RFC 2822 compatible email address parser

postTypeInit()[source]

class synapse.models.inet.Url(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

postTypeInit()[source]

synapse.models.inet.getAddrType(ip)[source]

synapse.models.infotech module

class synapse.models.infotech.Cpe22Str(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

CPE 2.2 Formatted String https://cpe.mitre.org/files/cpe-specification_2.2.pdf

class synapse.models.infotech.Cpe23Str(modl, name, info, opts)[source]

Bases: synapse.lib.types.Str

CPE 2.3 Formatted String

https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf

(Section 6.2)

cpe:2.3: part : vendor : product : version : update : edition :
    language : sw_edition : target_sw : target_hw : other

* = "any"
- = N/A

class synapse.models.infotech.ItModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

bruteVersionStr(valu)[source]

Brute force the version out of a string.

Parameters: valu (str) – String to attempt to get version information for.

Notes

This first attempts to parse strings using the it:semver normalization before attempting to extract version parts out of the string.

Returns: The system normalized version integer and a subs dictionary.
Return type: int, dict

getModelDefs()[source]

async initCoreModule()[source]

Module implementers may override this method to initialize the module after the Cortex has completed and is accessible to perform storage operations.

Notes

This is the preferred function to override for implementing custom code that needs to be executed during Cortex startup.

Any exception raised within this method will remove the module from the list of currently loaded modules.

This is called for modules after getModelDefs() and getStormCmds() has been called, in order to allow for model loading and storm command loading prior to code execution offered by initCoreModule.

A failure during initCoreModule will not unload data model or storm commands registered by the module.

Returns: None

class synapse.models.infotech.SemVer(modl, name, info, opts)[source]

Bases: synapse.lib.types.Int

Provides support for parsing a semantic version string into its component parts. This normalizes a version string into an integer to allow version ordering. Prerelease information is disregarded for integer comparison purposes, as we cannot map an arbitrary pre-release version into a integer value

Major, minor and patch levels are represented as integers, with a max width of 20 bits. The comparable integer value representing the semver is the bitwise concatenation of the major, minor and patch levels.

Prerelease and build information will be parsed out and available as strings if that information is present.

postTypeInit()[source]

repr(valu)[source]: Return a printable representation for the value. This may return a string or a tuple of values for display purposes.

synapse.models.infotech.chopCpe22(text)[source]: CPE 2.2 Formatted String https://cpe.mitre.org/files/cpe-specification_2.2.pdf

synapse.models.infotech.cpesplit(text)[source]

synapse.models.infotech.zipCpe22(parts)[source]

synapse.models.language module

class synapse.models.language.LangModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.material module

A data model focused on material objects.

class synapse.models.material.MatModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.media module

class synapse.models.media.MediaModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.orgs module

class synapse.models.orgs.OuModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.person module

class synapse.models.person.PsModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.proj module

class synapse.models.proj.ProjectModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

async initCoreModule()[source]

Module implementers may override this method to initialize the module after the Cortex has completed and is accessible to perform storage operations.

Notes

This is the preferred function to override for implementing custom code that needs to be executed during Cortex startup.

Any exception raised within this method will remove the module from the list of currently loaded modules.

This is called for modules after getModelDefs() and getStormCmds() has been called, in order to allow for model loading and storm command loading prior to code execution offered by initCoreModule.

A failure during initCoreModule will not unload data model or storm commands registered by the module.

Returns: None

synapse.models.risk module

class synapse.models.risk.RiskModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

synapse.models.syn module

class synapse.models.syn.SynModule(core, conf=None)[source]

Bases: synapse.lib.module.CoreModule

getModelDefs()[source]

initCoreModule()[source]

Module implementers may override this method to initialize the module after the Cortex has completed and is accessible to perform storage operations.

Notes

This is the preferred function to override for implementing custom code that needs to be executed during Cortex startup.

Any exception raised within this method will remove the module from the list of currently loaded modules.

This is called for modules after getModelDefs() and getStormCmds() has been called, in order to allow for model loading and storm command loading prior to code execution offered by initCoreModule.

A failure during initCoreModule will not unload data model or storm commands registered by the module.