oracle.ifs.core.tools.script.test.overrides.cyber.script

Class StixOperations

java.lang.Object

oracle.ifs.core.tools.script.ScriptOperations

oracle.ifs.core.extraction.script.ExtractionOperations

oracle.ifs.core.tools.script.test.overrides.cyber.script.StixOperations

All Implemented Interfaces:

AttributeValueGetter, Logger

public class StixOperations
extends ExtractionOperations

StixOperations defines operations used to create and manage Stix objects used as training and outcome for the STIX InformationExtraction implementation.

Author:

Dave Long

(Unpublished)

Nested Class Summary

Nested classes/interfaces inherited from class oracle.ifs.core.tools.script.ScriptOperations

ScriptOperations.ClassObjectOptions, ScriptOperations.JdbcExecutor, ScriptOperations.SavedSearchResult, ScriptOperations.ServerDefinition, ScriptOperations.ServiceDefinition

Field Summary

Fields inherited from class oracle.ifs.core.extraction.script.ExtractionOperations

CRLF, s_SignificantVerbLemmaEnMap, SIGNIFICANT_VERB_LEMMAS_EN

Fields inherited from class oracle.ifs.core.tools.script.ScriptOperations

INDENT

Constructor Summary

Constructors

Constructor and Description
StixOperations(ScriptDriver driver) Constructs a StixOperations.

Method Summary

Modifier and Type	Method and Description
void	createJsonStixReportBatch(AttributeValueTable avt) Creation a batch of JSON-based StixReports from an input file directory.
void	createStixAttackDamage(AttributeValueTable avt) Creates a StixAttackDamage.
void	createStixAttackIncident(AttributeValueTable avt) Creates a StixAttackIncident.
void	createStixAttackPattern(AttributeValueTable avt) Creates a StixAttackPattern.
void	createStixCampaign(AttributeValueTable avt) Creates a StixCampaign.
void	createStixCourseOfAction(AttributeValueTable avt) Creates a StixCourseOfAction.
void	createStixIdentity(AttributeValueTable avt) Creates a StixIdentity.
void	createStixIndicator(AttributeValueTable avt) Creates a StixIndicator.
void	createStixIntrusionSet(AttributeValueTable avt) Creates a StixIntrusionSet.
void	createStixLocation(AttributeValueTable avt) Creates a StixLocation.
void	createStixMalware(AttributeValueTable avt) Creates a StixMalware.
void	createStixObservedData(AttributeValueTable avt) Creates a StixObservedData.
void	createStixRelationObject(AttributeValueTable avt) Creates a StixRelationObject.
void	createStixThreatActor(AttributeValueTable avt) Creates a StixThreatActor.
void	createStixTimeReference(AttributeValueTable avt) Creates a StixTimeReference.
void	createStixTool(AttributeValueTable avt) Creates a StixTool.
void	createStixTrainingReport(AttributeValueTable avt) Creates a StixReport for training.
void	createStixVulnerability(AttributeValueTable avt) Creates a StixVulnerability.
void	executeStixTrainingReport(AttributeValueTable avt) Execute a previously created StixReport, for STIX training.
void	identifyStixReport(AttributeValueTable avt) Identify a StixReport from a solved/finished InformationExtraction.
protected StixDomainObject	lookupStixDomainObject(LibrarySession sess, String tag) Lookup a StixDomainObject by tag.
protected StixReport	lookupStixReport(LibrarySession sess, String tag) Lookup a StixReport by tag.
void	searchStixDomainObjectByIndexedName(AttributeValueTable avt) Search for StixDomainObject by INDEXEDNAME.
void	showCreatedStixReportObjects(AttributeValueTable avt) Shows the objects created as part of creating a StixReport from a solved/finished InformationExtraction.
void	showJson(AttributeValueTable avt) Parse explicit JSON, showing the resuls of the parse only.
protected void	showRelations(StixDomainObject obj, String prefix) Show the StixRelationObjects associated with the specified StixDomainObject.
void	showStixAttackDamage(StixAttackDamage obj, String prefix) Show details about a StixAttackDamage.
void	showStixAttackIncident(StixAttackIncident obj, String prefix) Show details about a StixAttackIncident.
void	showStixAttackPattern(StixAttackPattern obj, String prefix) Show details about a StixAttackPattern.
void	showStixCampaign(StixCampaign obj, String prefix) Show details about a StixCampaign.
void	showStixCourseOfAction(StixCourseOfAction obj, String prefix) Show details about a StixCourseOfAction.
void	showStixDomainObject(StixDomainObject obj, String prefix) Show details about a StixDomainObject.
void	showStixDomainObject(String tag) Show details about a StixDomainObject.
void	showStixIdentity(StixIdentity obj, String prefix) Show details about a StixIdentity.
void	showStixIndicator(StixIndicator obj, String prefix) Show details about a StixIndicator.
void	showStixIntrusionSet(StixIntrusionSet obj, String prefix) Show details about a StixIntrusionSet.
void	showStixLocation(StixLocation obj, String prefix) Show details about a StixLocation.
void	showStixMalware(StixMalware obj, String prefix) Show details about a StixMalware.
void	showStixObservedData(StixObservedData obj, String prefix) Show details about a StixObservedData.
void	showStixRelationObject(StixRelationObject obj, String prefix) Show details about a StixRelationObject.
void	showStixRelationObject(String tag) Show details about a StixRelationObject.
void	showStixReport(StixReport report, String prefix) Show details about a StixReport.
void	showStixReportBatch(AttributeValueTable avt) Shows the batch of StixReports from an input file directory.
void	showStixReportBatch(Folder topFolder, boolean verbose, String indent) Shows the batch of StixReports under a folder.
void	showStixThreatActor(StixThreatActor obj, String prefix) Show details about a StixThreatActor.
void	showStixTimeReference(StixTimeReference obj, String prefix) Show details about a StixTimeReference.
void	showStixTool(StixTool obj, String prefix) Show details about a StixTool.
void	showStixVulnerability(StixVulnerability obj, String prefix) Show details about a StixVulnerability.

Methods inherited from class oracle.ifs.core.extraction.script.ExtractionOperations

addConfirmedResult, addEventAssignmentTable, addEventAssignmentTables, addFinisherOverrideSetting, addInformationExtractionEntityPhrase, addInformationExtractionEntityRelationType, addInformationExtractionEntityType, addInformationExtractionImplicitEntityRelation, addInformationExtractionLegalEntityRelation, addInformationExtractionRegexMapping, addInformationExtractionRegexPattern, addInformationExtractionRegexRule, addInformationExtractionSetting, addParserOverrideSetting, addPreparerOverrideSetting, addProperty, addSetting, addSettings, addSolverOverrideSetting, addTrainerOverrideSetting, addTrainingSetClassifierDocument, addTrainingSetRelationDocument, addUnconfirmedResult, cancelConfirmedInformationExtraction, confirmInformationExtraction, createCoreNlpRegexRuleDocument, createDependencyMatcherRegexRuleJsonDocument, createEntityRulerRegexRuleJsonDocument, createInformationExtraction, createInformationExtractionBatch, createInformationExtractionDomainSpecification, createInformationExtractionFinisherSpecification, createInformationExtractionParserSpecification, createInformationExtractionPreparerSpecification, createInformationExtractionSolverSpecification, createInformationExtractionSpecification, createInformationExtractionTrainerSpecification, createJsonPhraseDocumentBatch, createLegalImplicitRelationsDocument, createMarking, createNerClassifierDocument, createRegexPatternDocument, createRegexPatternJsonDocument, createRegexRuleDocument, createRegexRuleJsonDocument, createRelationMentionModelDocument, createResultSet, createSpacyClassifierDocument, createTokenMatcherRegexRuleJsonDocument, createTrainingExportSet, createTrainingSet, deriveMarkingSource, deriveRelationSource, executeInformationExtraction, executePythonScript, executePythonScriptIO, exportNerClassifierModelData, exportRelationMentionModelData, freeInformationExtractionDomainSpecification, freeInformationExtractionFinisherSpecification, freeInformationExtractionParserSpecification, freeInformationExtractionPreparerSpecification, freeInformationExtractionSolverSpecification, freeInformationExtractionSpecification, freeInformationExtractionTrainerSpecification, identifyInformationExtractionDomainSpecification, identifyInformationExtractionFinisherSpecification, identifyInformationExtractionParserSpecification, identifyInformationExtractionPreparerSpecification, identifyInformationExtractionSolverSpecification, identifyInformationExtractionSpecification, identifyInformationExtractionTrainerSpecification, importNerClassifierModelData, importRelationMentionModelData, isLegalCoreNlpRegexRule, isLegalRegexPattern, listFiles, lookupInformationExtraction, lookupInformationExtractionAbstractSpecification, lookupInformationExtractionDomainSpecification, lookupInformationExtractionFinisherSpecification, lookupInformationExtractionParserSpecification, lookupInformationExtractionPreparerSpecification, lookupInformationExtractionSolverSpecification, lookupInformationExtractionSpecification, lookupInformationExtractionTrainerSpecification, parseMarkingTag, parseMarkingType, regenerateClassifierTrainingDocuments, removeTrainingExportSet, replaceEventAssignmentTableList, searchInformationExtractionEntityPhrases, setConfirmedOutcome, setInformationExtractionState, showAllInformationExtractionDomainSpecifications, showAllInformationExtractionFinisherSpecifications, showAllInformationExtractionParserSpecifications, showAllInformationExtractionPreparerSpecifications, showAllInformationExtractionSolverSpecifications, showAllInformationExtractionSpecifications, showAllInformationExtractionTrainerSpecifications, showClassifierTrainingDocument, showConllRelationTrainingDocument, showInformationExtraction, showInformationExtraction, showInformationExtractionClassifierHits, showInformationExtractionCorefChain, showInformationExtractionDependencyGraphEdge, showInformationExtractionDomainSpecification, showInformationExtractionDomainSpecification, showInformationExtractionEntityMention, showInformationExtractionEntityPhrase, showInformationExtractionFinisherSpecification, showInformationExtractionFinisherSpecification, showInformationExtractionOutcome, showInformationExtractionOutcome, showInformationExtractionOutcomeMarking, showInformationExtractionOutcomeMarkingRelation, showInformationExtractionParserSpecification, showInformationExtractionParserSpecification, showInformationExtractionPreparerSpecification, showInformationExtractionPreparerSpecification, showInformationExtractionRelationMention, showInformationExtractionRelationTriple, showInformationExtractionResultSet, showInformationExtractionSentence, showInformationExtractionSolverSpecification, showInformationExtractionSolverSpecification, showInformationExtractionSpecification, showInformationExtractionSpecification, showInformationExtractionToken, showInformationExtractionTokenList, showInformationExtractionTokens, showInformationExtractionTrainerSpecification, showInformationExtractionTrainerSpecification, showInformationExtractionTrainingSet, showOutcomeAsConfirmationInput, showOutcomeAsTsv, showOutcomeGraphSummaryDocument, showOutcomeTextSummaryDocument, showResultSet, showSearchTerm, showSpacyClassifierTrainingDocument, showTrainingExportSet, showTrainingSet, syncInformationExtractionEntityPhraseIndex

Methods inherited from class oracle.ifs.core.tools.script.ScriptOperations

abortTransaction, acquireLock, acquireManualLock, activateAuditHandlerSpecification, activateAuditSpecification, activateOperationActionSpecification, activateServerSpecification, activateSystemObject, addAttachment, addAttribute, addAuditEventProperty, addAuditType, addAuditTypesForClass, addBooleanHandlerProperty, addCategory, addDefinitionAuditEntryType, addDefinitionAuditEntryTypesForClass, addDefinitionAuditEntryTypesUnderClass, addDefinitionBooleanProperty, addDefinitionDoubleProperty, addDefinitionIntegerProperty, addDefinitionLongProperty, addDefinitionProperties, addDefinitionProperty, addDefinitionStringArrayProperty, addDefinitionStringProperty, addDocumentDefinitionCharacterSet, addDocumentDefinitionContent, addDocumentDefinitionContentBfileReference, addDocumentDefinitionLanguage, addEventsToAuditSpecification, addGlobalOperationActionSpecification, addGroupMember, addGroupMembers, addIntegerHandlerProperty, addItem, addLifecyclePolicyEntryDefinition, addLifecyclePolicyEntryDefinition, addLongHandlerProperty, addManagedServerDeclaration, addManagedServerDeclaration, addManagedServerDeclaration, addManagedServiceDeclaration, addManagedServiceDeclaration, addPreparedSelectorBindValue, addPreparedSelectorBooleanBindValue, addPreparedSelectorIntegerBindValue, addPreparedSelectorLibraryObjectBindValue, addPreparedSelectorLongBindValue, addPreparedSelectorStringBindValue, addPublicObjectDefinitionCategory, addSchemaObjectDefinitionCategory, addStringArrayHandlerProperty, addStringHandlerProperty, addSystemObjectDefinitionBooleanProperty, addSystemObjectDefinitionCategory, addSystemObjectDefinitionIntegerProperty, addSystemObjectDefinitionLongProperty, addSystemObjectDefinitionStringArrayProperty, addSystemObjectDefinitionStringProperty, addToDocumentDefinition, addToPublicObjectDefinition, applyLogLevelOverride, applyNamedFreezeLock, applySingletonLock, assignClassDomain, assignLifecyclePolicyByCategory, assignValueDefault, assignValueDomain, beginTransaction, businessObjectExists, clearImpersonateUser, clearSharedCaches, cloneCurrentSession, cloneDefinition, cloneDefinition, comment, comment, compareObjects, completeTransaction, concatenateObjectId, concatenateStrings, concatenateStrings, concatenateStrings, concatenateStrings, concatenateStrings, concatenateStrings, concatenateStrings, concatenateToLowerStrings, concatenateToLowerStrings, concatenateToLowerStrings, concatenateToUpperStrings, concatenateToUpperStrings, concatenateToUpperStrings, connect, connect, constructAuditEvent, constructPreparedSelectorGenerator, constructPreparedSelectorGenerator, convertPropertyDefinitionsToHashtable, convertStringArray, convertToBoolean, convertToBoolean, convertToDouble, convertToDouble, convertToInteger, convertToInteger, convertToLong, convertToLong, convertToRelativePath, convertToTable, convertToValue, copy, copyAuditSpecification, copySimplePropertyTable, copySimplePropertyTableList, create, createAccessControlList, createAndApplyAuditTypeList, createApplicationToken, createApplicationToken, createAuditSpecification, createAuditSpecification, createAuditSpecification, createAuditSpecification, createAuditTypeList, createAuditTypeList, createAutoFolderingActionSpecification, createAutoFolderingActionSpecification, createCategorizedDocument, createClassDomain, createClassObject, createClassObject, createCustomLockEntry, createCustomMediaDriverSpecification, createCustomMediaDriverSpecification, createDefinition, createDefinitionFromDefinitionObject, createDefinitionFromObject, createDefinitionObject, createDependentView, createDispatchingHandlerSpecification, createDocument, createDocument, createDocument, createDocumentBatch, createDocuments, createEntireAuditSpecification, createExtendedPermission, createExtendedUserProfile, createFolder, createFolder, createFolder, createFolderLink, createFolderTree, createFormat, createGroup, createGuestSession, createLibraryObject, createLibraryObject, createLifecycleDateRuleSpecification, createLifecycleDateRuleSpecification, createLifecyclePolicy, createLifecyclePolicy, createLifecyclePolicyActionSpecification, createLifecyclePolicyActionSpecification, createLifecyclePolicyEntryDefinition, createLink, createLink, createLink, createLockTypeLookupTables, createMedia, createMedia, createNamedFreezeLock, createNamedPropertyBundle, createNodeConfiguration, createNodeConfiguration, createOperationActionSpecification, createOperationActionSpecification, createOrUpdateClassObject, createPermissionBundle, createPolicy, createPolicyList, createPropertyBundle, createQueue, createRetentionPolicy, createServerConfiguration, createServerConfiguration, createServerSpecification, createServiceConfiguration, createServiceConfiguration, createSession, createSession, createSimplePropertyTable, createSimplePropertyTableList, createStorageGroup, createStorageGroup, createSystemLockObject, createUser, createUserSession, createValueDefault, createValueDomain, deactivateAuditHandlerSpecification, deactivateAuditSpecification, deactivateOperationActionSpecification, deactivateServerSpecification, deactivateSystemObject, deactivateUnknownOperationActionSpecifications, defineAttribute, defineAuditHandlerSpecificationDefinition, defineAuditHandlerSpecificationDefinition, defineAuditTargetSpecificationDefinition, defineAuditTypeListDefinition, defineAuditTypeListDefinition, defineClassObject, defineExistingClassObject, definitionExists, deleteAllCategories, deleteAuditSpecification, deleteNamedFreezeLock, deleteRepositoryParameter, deleteUser, deregisterBusinessObject, deregisterCustomLockType, deregisterDefinition, deregisterLockType, deregisterObject, deregisterSession, deregisterTransaction, determinePrimaryObjectColumnAlias, ensureFreed, executeAutocommitSql, executePreparedSelect, executePreparedSelect, executePreparedSelect, executePreparedSelect, executePreparedSelectCount, executePreparedSelectCount, executePreparedSelectCount, executePreparedSelectFromJson, executePreparedSelectResults, exists, existsRelative, extractContentForIndexing, findOrCreateCompositeGroup, freeClassDomain, freeClassObject, freeExtendedPermission, freeFolder, freeFormat, freeNamedPropertyBundle, freeNamedPropertyBundle, freeNodeConfiguration, freeNodeConfiguration, freeObject, freePermissionBundle, freePolicy, freeServerConfiguration, freeServerConfiguration, freeServiceConfiguration, freeServiceConfiguration, freeUnreferencedContent, freeValueDefault, freeValueDomain, generateClassObjectDefinitionTag, getAbsolutePath, getAclValueForConfigurationObjects, getAttributeValue, getAttributeValue, getAttributeValue, getAuditDriverHelper, getAuditEventDispatcher, getAuditingStartingId, getAuxiliaryTargets, getBindValues, getBypassSecurityAliases, getClassObjectCreationMode, getConsoleInputBoolean, getConsoleInputString, getConsoleInputString, getConsoleInputString, getConsoleSecureInputString, getContentPath, getCurrentSession, getDriver, getIncludedFileSettings, getLogWriter, getManagedServerDeclarations, getManagedServiceDeclarations, getParameterTable, getSavedSearchResultPrimaryObjects, getSavedSearchResults, getShowDates, getStringArray, getStringsFromArrayToken, getStripNumbersFromAuditEventProperties, handleEventPostedForCustomAuditHistory, handleTimerExpiredForCustomAuditHistory, identifyAcl, identifyAcl, identifyApplicationToken, identifyAttribute, identifyAttributePropertyBundle, identifyAuditHandlerSpecification, identifyAuditSpecification, identifyAuditTargetSpecification, identifyAuditTypeList, identifyAuditTypeListBySpecification, identifyAutoFolderingActionSpecification, identifyByAttribute, identifyByPath, identifyByRelativePath, identifyCategory, identifyCategory, identifyClassAcl, identifyClassDomain, identifyClassObject, identifyClassPolicyBundle, identifyClassPropertyBundle, identifyCompositeGroup, identifyCustomLock, identifyCustomMediaDriverSpecification, identifyDependentView, identifyDispatchingHandlerSpecification, identifyExtendedPermission, identifyFormat, identifyGlobalAuditSpecification, identifyGlobalAuditTypeList, identifyGroup, identifyGuestUser, identifyInstancePropertyBundle, identifyLibraryObject, identifyLifecycleDateRuleSpecification, identifyLifecyclePolicy, identifyLifecyclePolicyActionSpecification, identifyLifecyclePolicyEntry, identifyMedia, identifyMessageEntry, identifyMessageList, identifyNamedFreezeLock, identifyNamedPropertyBundle, identifyNodeConfiguration, identifyObjectAuditSpecification, identifyObjectProperty, identifyOperationActionSpecification, identifyPermissionBundle, identifyPolicy, identifyPolicyList, identifyPrimaryUserProfile, identifyPropertyBundle, identifyQueue, identifyQueueTypeMapBundle, identifyRetentionPolicy, identifyServerConfiguration, identifyServerSpecification, identifyServiceConfiguration, identifySingletonLockType, identifyStorageGroup, identifySystemAcl, identifySystemLockObject, identifySystemUser, identifyUser, identifyValueDefault, identifyValueDomain, identifyWorkingHandler, identifyWorldGroup, impersonateUser, impersonateUser, initializeManualTextIndexingRetainedEvents, isBootstrapModeEnabled, isDomainScopeImpliedForSearch, isInArray, log, log, lookupAcl, lookupApplicationToken, lookupAuditDomainContext, lookupAuditSpecification, lookupAutoFolderingActionSpecification, lookupBusinessObject, lookupBusinessObjectHashtable, lookupBusinessObjectList, lookupClassAcl, lookupDatatype, lookupDatatypeString, lookupDefinition, lookupDefinition, lookupDirectoryObject, lookupDispatchingHandlerSpecification, lookupDocument, lookupFolder, lookupFormat, lookupFormatFromCollection, lookupGroup, lookupMedia, lookupMessageEntry, lookupObject, lookupObject, lookupObjectAttributeValue, lookupObjectId, lookupOperationActionSpecification, lookupPublicObject, lookupQueue, lookupServerSpecification, lookupSessionByTag, lookupSystemAcl, lookupSystemLockObject, lookupTagBySessionId, lookupUser, lookupUserFromCollection, makeDefinitionReadOnly, markCurrentAuditingId, modifyClassObject, move, moveCategory, normalizeBooleanString, notifyCustomAuditHistoryHandler, objectExists, populateFolderTree, postCustomAuditEvent, postCustomAuditEvent, postCustomAuditEvent, postSystemAuditEvent, postSystemAuditEvent, preprocessDocumentSettings, preprocessPublicObjectSettings, printStackTrace, processAllEvents, processManualTextIndexingRetainedEvents, processRawAuditEvents, purgeGlobalAuditHistory, reactivateUnknownOperationActionSpecifications, readDocumentContent, refreshDependentView, registerAllNonCustomAuditTypes, registerAuditEventType, registerAuditEventType, registerBusinessObject, registerCustomAuditType, registerCustomAuditTypeForAnyTarget, registerCustomLockType, registerDefinition, registerLockType, registerNewSession, registerObject, registerTransaction, releaseLock, releaseManualLock, removeAcesForFreedGrantees, removeAllAttachments, removeAttachment, removeAttribute, removeClassProperty, removeCustomLockEntry, removeGroupMembers, removeItem, removeNamedFreezeLock, removeProperties, removeServerFromNodeConfiguration, removeServiceFromNodeConfiguration, removeSession, removeSessionState, removeSingletonLock, removeTag, rename, replaceMediaLookupsByFormat, replaceSession, resetFolderCountInfo, restoreGlobalOperationActionSpecification, runSchemaCreator, runScript, saveGlobalOperationActionSpecification, saveSearchResultPrimaryObjects, saveSearchResults, searchAuditHistory, searchAuditHistory, searchAuditHistory, sessionExists, setActiveWorkerRebalanceRequest, setAdminMode, setAdminMode, setArrayTokenDelimiter, setAuditingStartingId, setAuditSpecificationAuditHandlerSpecificationDefinition, setAuditSpecificationAuditTargetSpecificationDefinition, setAuditSpecificationAuditTypeListDefinition, setAuditTargetSpecificationDefinitionTarget, setBooleanInstanceProperty, setClassObjectCreationMode, setClassPolicyList, setClassProperty, setCreateCategoriesServerSideOption, setCurrentSession, setCurrentSession, setDateFormat, setDateFormat, setDefaultAuditEventSortClause, setDefaultMedia, setDefaultScriptOperationsClass, setDefaultStorageGroup, setDefinitionAttribute, setDefinitionAttribute, setDefinitionBooleanAttribute, setDefinitionClassObjectAttribute, setDefinitionDateAttribute, setDefinitionDirectoryObjectArrayAttribute, setDefinitionDirectoryObjectAttribute, setDefinitionDoubleAttribute, setDefinitionIntegerAttribute, setDefinitionLongAttribute, setDefinitionNullStringAttribute, setDefinitionObjectAttribute, setDefinitionSchemaObjectArrayAttribute, setDefinitionSchemaObjectAttribute, setDefinitionStringArrayAttribute, setDefinitionStringAttribute, setDefinitionSystemObjectAttribute, setDocumentDefinitionContentObjectDefinition, setGlobalAuditTypeList, setGlobalOperationActionSpecifications, setInactiveWorkerRebalanceRequest, setInstallationMode, setInstallationMode, setInstanceProperty, setIntegerInstanceProperty, setLifecyclePolicyDefinitionDeleteEntriesOption, setLocale, setLongInstanceProperty, setLongSessionState, setMainSessionAsCurrentSession, setMediaLookupByFormat, setNumberFormat, setObjectProperty, setPreventSessionTimeouts, setPreventSessionTimeouts, setProperty, setPublicObjectInstanceProperty, setRepositoryParameter, setScriptTerminated, setScriptTerminated, setStringInstanceProperty, setStringSessionState, setSubstitutionPrefix, setSystemAdminMode, setSystemAdminMode, setSystemObjectInstanceProperty, setTimeoutPeriodOption, setTimeZone, setUserCreateOptions, setUserDefaultAcl, setUserDeleteOptions, showAcl, showAggregateAuditEventColumns, showAllAutoFolderingActionSpecifications, showAllClassAcls, showAllClassDomains, showAllClassObjects, showAllCustomAuditSpecifications, showAllCustomMediaDriverSpecifications, showAllDependentViews, showAllExtendedPermissions, showAllExternalRetentionPolicies, showAllFormats, showAllLifecycleDateRuleSpecifications, showAllLifecyclePolicies, showAllLifecyclePolicyActionSpecifications, showAllMedias, showAllNodeConfigurations, showAllNodeConfigurations, showAllOperationActionSpecifications, showAllPermissionBundles, showAllPolicies, showAllPolicyLists, showAllRepositoryParameters, showAllRetentionPolicies, showAllServerConfigurations, showAllServerConfigurations, showAllServerSpecifications, showAllServiceConfigurations, showAllServiceConfigurations, showAllStorageGroups, showAllSystemAcls, showAllValueDefaults, showAllValueDomains, showApplicationToken, showApplicationTokens, showAttachments, showAttribute, showAttribute, showAuditCertificates, showAuditEventOperationTypes, showAuditSpecification, showAuditTargetCodes, showAuditTypeList, showAuditTypesForClass, showAuditTypesForCreateOperations, showAuditTypesForFreeOperations, showAuditTypesUnderClass, showAutoFolderingActionSpecification, showBindValues, showCapabilities, showClassDomain, showClassDomain, showClassInfoTable, showClassObject, showClassObjectAndSubNames, showClassObjectAndSubs, showCompositeGroup, showCreateClassObjectScript, showCurrentUser, showCustomAuditHistory, showCustomAuditHistory, showCustomAuditTypes, showCustomMediaDriverSpecification, showDefaultMedia, showDefaultStorageGroup, showDefineAttributeScript, showDefinition, showDefinitionObject, showDependentView, showDocument, showDocumentCharacterSet, showDocumentContentInfo, showDocumentContents, showDocumentContents, showDocumentContents, showDocumentLanguage, showDocumentsWithLifecyclePolicy, showExpandedAuditTypeList, showExtendedPermission, showFolder, showFolder, showFolderCountInfo, showFormat, showGlobalAuditHistory, showGlobalAuditHistory, showGlobalAuditSpecification, showGlobalAuditTypeList, showGlobalOperationActionSpecifications, showGroup, showInstanceProperty, showInstancePropertyBundle, showLibraryObject, showLibraryObject, showLifecycleDateRuleSpecification, showLifecyclePolicy, showLifecyclePolicyActionSpecification, showLifecyclePolicyEntry, showLink, showLocalizer, showLockEntry, showLockEntryInfo, showLockTypeLookupTables, showMedia, showMediaLookupByFormatMappings, showMessageEntry, showMessageList, showNamedPropertyBundle, showNodeConfiguration, showNodeConfiguration, showObject, showObjectAuditHistory, showObjectAuditHistory, showObjectAuditSpecification, showOperationActionSpecification, showParsedArrayToken, showParsedOperationString, showPermissionBundle, showPolicy, showPolicyList, showPreparedSelector, showPreparedSelector, showPreparedSelectorGeneratedSql, showPreparedSelectorGeneratedSql, showPreparedSelectorSearchTargetsTable, showProperty, showPropertyBundle, showRepositoryParameter, showRetentionPolicy, showRuntimeStatistics, showSavedSearchResultPrimaryObjects, showSavedSearchResults, showServerConfiguration, showServerConfiguration, showServerSpecification, showServiceConfiguration, showServiceConfiguration, showServiceStatistics, showSessionCacheStatistics, showSessionState, showSimplePropertyTable, showSimplePropertyTableList, showStorageGroup, showUser, showValueDefault, showValueDefault, showValueDomain, showValueDomain, sleep, syncContentIndex, syncIndex, testJsonString, tokenToDirectoryObjectArray, tokenToDirectoryUserArray, tokenToDocumentArray, transactionExists, unregisterAuditEventType, unregisterCustomAuditType, update, updateAccessControlList, updateAllWorkers, updateAllWorkersAndTemplate, updateClassDomain, updateDefinitionObject, updateLibraryObject, updateLibraryObject, updateLibraryObject, updateNodeConfiguration, updateNodeConfiguration, updateServerConfiguration, updateServerConfiguration, updateServiceConfiguration, updateServiceConfiguration, updateUserPassword, updateValueDefault, updateValueDomain, updateWorkerTemplate, verifyBusinessObjectTagNotExists, verifyDefinitionTagNotExists, verifyDefinitionWriteable, verifyObjectTagNotExists, writeConsoleOutputString, writeConsoleOutputString, writeDocumentContentToFile, zeroPad

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

StixOperations

public StixOperations(ScriptDriver driver)

Constructs a StixOperations.

Parameters:

driver - the main script driver instance

(Published)

Method Detail

searchStixDomainObjectByIndexedName

public void searchStixDomainObjectByIndexedName(AttributeValueTable avt)
                                         throws IfsException

Search for StixDomainObject by INDEXEDNAME.

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

createStixTrainingReport

public void createStixTrainingReport(AttributeValueTable avt)
                              throws IfsException

Creates a StixReport for training.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixReport
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixReport name
• DESCRIPTION: the StixReport description
• TYPE: the type of report (training, eval)
• INPUTFORMAT: the input format for the report (none, stix-json, csv-attackpattern, csv-vulnerability, def)
• REPORTFOLDER: the report folder that was manually precreated
• SOURCEDOCUMENT: the source Document that was manually precreated
• TOKENSDOCUMENT: the tokens Document that was manually precreated

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

identifyStixReport

public void identifyStixReport(AttributeValueTable avt)
                        throws IfsException

Identify a StixReport from a solved/finished InformationExtraction.

The keys supported by this operation:

• REPORTTAG (or TAG): the tag that will identify the StixReport
• EXTRACTIONTAG: the tag that identifies the InformationExtraction

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showCreatedStixReportObjects

public void showCreatedStixReportObjects(AttributeValueTable avt)
                                  throws IfsException

Shows the objects created as part of creating a StixReport from a solved/finished InformationExtraction.

The keys supported by this operation:

• REPORTTAG (or TAG): the tag that identifies the StixReport
• SHOWSTIXDOMAINOBJECTS: whether to show the created StixDomainObjects
• SHOWSTIXRELATIONOBJECTS: whether to show the created StixRelationObjects

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixReport

public void showStixReport(StixReport report,
                           String prefix)
                    throws IfsException

Show details about a StixReport.

Parameters:

report - the StixReport to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixThreatActor

public void createStixThreatActor(AttributeValueTable avt)
                           throws IfsException

Creates a StixThreatActor.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixThreatActor
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixThreatActor name
• DESCRIPTION: the StixThreatActor description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)
• ALIASES: any aliases for the Threat actor

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixThreatActor

public void showStixThreatActor(StixThreatActor obj,
                                String prefix)
                         throws IfsException

Show details about a StixThreatActor.

Parameters:

obj - the StixThreatActor to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixIntrusionSet

public void createStixIntrusionSet(AttributeValueTable avt)
                            throws IfsException

Creates a StixIntrusionSet.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixIntrusionSet
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixIntrusionSet name
• DESCRIPTION: the StixIntrusionSet description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixIntrusionSet

public void showStixIntrusionSet(StixIntrusionSet obj,
                                 String prefix)
                          throws IfsException

Show details about a StixIntrusionSet.

Parameters:

obj - the StixIntrusionSet to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixCampaign

public void createStixCampaign(AttributeValueTable avt)
                        throws IfsException

Creates a StixCampaign.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixCampaign
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixCampaign name
• DESCRIPTION: the StixCampaign description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• OBJECTIVE: the objective for this camapaign
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixCampaign

public void showStixCampaign(StixCampaign obj,
                             String prefix)
                      throws IfsException

Show details about a StixCampaign.

Parameters:

obj - the StixCampaign to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixAttackIncident

public void createStixAttackIncident(AttributeValueTable avt)
                              throws IfsException

Creates a StixAttackIncident.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixAttackIncident
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixAttackIncident name
• DESCRIPTION: the StixAttackIncident description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixAttackIncident

public void showStixAttackIncident(StixAttackIncident obj,
                                   String prefix)
                            throws IfsException

Show details about a StixAttackIncident.

Parameters:

obj - the StixAttackIncident to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixAttackDamage

public void createStixAttackDamage(AttributeValueTable avt)
                            throws IfsException

Creates a StixAttackDamage.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixAttackDamage
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixAttackDamage name
• DESCRIPTION: the StixAttackDamage description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixAttackDamage

public void showStixAttackDamage(StixAttackDamage obj,
                                 String prefix)
                          throws IfsException

Show details about a StixAttackDamage.

Parameters:

obj - the StixAttackDamage to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixAttackPattern

public void createStixAttackPattern(AttributeValueTable avt)
                             throws IfsException

Creates a StixAttackPattern.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixAttackPattern
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixAttackPattern name
• DESCRIPTION: the StixAttackPattern description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)
• KILLCHAINPHASES: the String array of kill chain phases

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixAttackPattern

public void showStixAttackPattern(StixAttackPattern obj,
                                  String prefix)
                           throws IfsException

Show details about a StixAttackPattern.

Parameters:

obj - the StixAttackPattern to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixMalware

public void createStixMalware(AttributeValueTable avt)
                       throws IfsException

Creates a StixMalware.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixMalware
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixMalware name
• DESCRIPTION: the StixMalware description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)
• KILLCHAINPHASES: the String array of kill chain phases

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixMalware

public void showStixMalware(StixMalware obj,
                            String prefix)
                     throws IfsException

Show details about a StixMalware.

Parameters:

obj - the StixMalware to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixTool

public void createStixTool(AttributeValueTable avt)
                    throws IfsException

Creates a StixTool.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixTool
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixTool name
• DESCRIPTION: the StixTool description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)
• KILLCHAINPHASES: the String array of kill chain phases
• TOOLVERSION: the tool version

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixTool

public void showStixTool(StixTool obj,
                         String prefix)
                  throws IfsException

Show details about a StixTool.

Parameters:

obj - the StixTool to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixVulnerability

public void createStixVulnerability(AttributeValueTable avt)
                             throws IfsException

Creates a StixVulnerability.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixVulnerability
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixVulnerability name
• DESCRIPTION: the StixVulnerability description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixVulnerability

public void showStixVulnerability(StixVulnerability obj,
                                  String prefix)
                           throws IfsException

Show details about a StixVulnerability.

Parameters:

obj - the StixVulnerability to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixCourseOfAction

public void createStixCourseOfAction(AttributeValueTable avt)
                              throws IfsException

Creates a StixCourseOfAction.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixCourseOfAction
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixCourseOfAction name
• DESCRIPTION: the StixCourseOfAction description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixCourseOfAction

public void showStixCourseOfAction(StixCourseOfAction obj,
                                   String prefix)
                            throws IfsException

Show details about a StixCourseOfAction.

Parameters:

obj - the StixCourseOfAction to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixLocation

public void createStixLocation(AttributeValueTable avt)
                        throws IfsException

Creates a StixLocation.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixLocation
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixLocation name
• DESCRIPTION: the StixLocation description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixLocation

public void showStixLocation(StixLocation obj,
                             String prefix)
                      throws IfsException

Show details about a StixLocation.

Parameters:

obj - the StixLocation to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixTimeReference

public void createStixTimeReference(AttributeValueTable avt)
                             throws IfsException

Creates a StixTimeReference.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixTimeReference
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixTimeReference name
• DESCRIPTION: the StixTimeReference description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixTimeReference

public void showStixTimeReference(StixTimeReference obj,
                                  String prefix)
                           throws IfsException

Show details about a StixTimeReference.

Parameters:

obj - the StixTimeReference to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixIndicator

public void createStixIndicator(AttributeValueTable avt)
                         throws IfsException

Creates a StixIndicator.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixIndicator
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixIndicator name
• DESCRIPTION: the StixIndicator description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixIndicator

public void showStixIndicator(StixIndicator obj,
                              String prefix)
                       throws IfsException

Show details about a StixIndicator.

Parameters:

obj - the StixIndicator to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixObservedData

public void createStixObservedData(AttributeValueTable avt)
                            throws IfsException

Creates a StixObservedData.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixObservedData
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixObservedData name
• DESCRIPTION: the StixObservedData description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixObservedData

public void showStixObservedData(StixObservedData obj,
                                 String prefix)
                          throws IfsException

Show details about a StixObservedData.

Parameters:

obj - the StixObservedData to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixIdentity

public void createStixIdentity(AttributeValueTable avt)
                        throws IfsException

Creates a StixIdentity.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixIdentity
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixIdentity name
• DESCRIPTION: the StixIdentity description
• STATUS: the status of the object (common, reported-training, reported-eval, reported-duplicate)
• REPORT: the report that is creating this object (can be null)
• TYPE: the StixIdentity type: attacker, defender, or observer
• SECTORS: the Sectors this identity is associated with
• CONTACTINFO: the contact info for the identity

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixIdentity

public void showStixIdentity(StixIdentity obj,
                             String prefix)
                      throws IfsException

Show details about a StixIdentity.

Parameters:

obj - the StixIdentity to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

createStixRelationObject

public void createStixRelationObject(AttributeValueTable avt)
                              throws IfsException

Creates a StixRelationObject.

The keys supported by this operation:

• TAG: the tag that identifies the newly created StixRelationObject
• DEFTAG: the definition tag to use as the base definition
• NAME: the StixRelationObject name (optional)
• DESCRIPTION: the StixRelationObject description (optional)
• TYPE: the StixRelationObject type: related_to, duplicate_of, derived_from, targets, attributed_to, uses, variant_of, mitigates, impersonates, indicates, or cooperating
• LEFTOBJECT: the left object tag
• RIGHTOBJECT: the right object tag

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixRelationObject

public void showStixRelationObject(String tag)
                            throws IfsException

Show details about a StixRelationObject.

Parameters:

name - the StixRelationObject tag

Throws:

IfsException - if the operation fails

showStixRelationObject

public void showStixRelationObject(StixRelationObject obj,
                                   String prefix)
                            throws IfsException

Show details about a StixRelationObject.

Parameters:

obj - the StixRelationObject to show

prefix - the indentation prefix

Throws:

IfsException - if the operation fails

showStixDomainObject

public void showStixDomainObject(String tag)
                          throws IfsException

Show details about a StixDomainObject.

Parameters:

tag - the StixDomainObject tag

Throws:

IfsException - if the operation fails

showStixDomainObject

public void showStixDomainObject(StixDomainObject obj,
                                 String prefix)
                          throws IfsException

Show details about a StixDomainObject.

Parameters:

tag - the StixDomainObject tag

Throws:

IfsException - if the operation fails

showJson

public void showJson(AttributeValueTable avt)
              throws IfsException

Parse explicit JSON, showing the resuls of the parse only.

The keys supported by this operation:

• TEXT: the JSON text

Overrides:

showJson in class ExtractionOperations

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

executeStixTrainingReport

public void executeStixTrainingReport(AttributeValueTable avt)
                               throws IfsException

Execute a previously created StixReport, for STIX training.

For JSON reports, this performs a StixJsonParser prepare() and execute().

The keys supported by this operation:

• REPORT (or TAG): the report to be executed
• VERBOSE: whether the output should be verbose

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

createJsonStixReportBatch

public void createJsonStixReportBatch(AttributeValueTable avt)
                               throws IfsException

Creation a batch of JSON-based StixReports from an input file directory.

The keys supported by this operation:

• REPORTTOPFOLDER: the top folder (parent of the report folders)
• FILEDIRECTORY: the file directory

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixReportBatch

public void showStixReportBatch(AttributeValueTable avt)
                         throws IfsException

Shows the batch of StixReports from an input file directory.

The keys supported by this operation:

• REPORTTOPFOLDER: the top folder (parent of the report folders)
• VERBOSE: whether the output should be verbose

Parameters:

avt - the named arguments

Throws:

IfsException - if the operation fails

showStixReportBatch

public void showStixReportBatch(Folder topFolder,
                                boolean verbose,
                                String indent)
                         throws IfsException

Shows the batch of StixReports under a folder.

Parameters:

topFolder - the top folder

verbose - whether the output should be verbose

Throws:

IfsException - if the operation fails

showRelations

protected void showRelations(StixDomainObject obj,
                             String prefix)
                      throws IfsException

Show the StixRelationObjects associated with the specified StixDomainObject.

Parameters:

obj - the StixDomainObject

prefix - the logging prefix

Throws:

IfsException - if the operation fails

lookupStixDomainObject

protected StixDomainObject lookupStixDomainObject(LibrarySession sess,
                                                  String tag)
                                           throws IfsException

Lookup a StixDomainObject by tag.

A RuntimeException is thrown if there is no object registered with the specified tag, or if the object registered is not a StixDomainObject.

Parameters:

sess - the session

tag - the object tag

Returns:

the object

Throws:

IfsException - if the operation fails

(Published)

lookupStixReport

protected StixReport lookupStixReport(LibrarySession sess,
                                      String tag)
                               throws IfsException

Lookup a StixReport by tag.

A RuntimeException is thrown if there is no object registered with the specified tag, or if the object registered is not a StixReport.

Parameters:

sess - the session

tag - the object tag

Returns:

the object

Throws:

IfsException - if the operation fails

(Published)