libtaxii.messages_10
Module
Version: 1.1.119
Creating, handling, and parsing TAXII 1.0 messages.
Note
The examples on this page assume that you have run the equivalent of
import datetime
from dateutil.tz import tzutc
import libtaxii as t
import libtaxii.messages_10 as tm10
from libtaxii.constants import *
Status Message¶
-
class
libtaxii.messages_10.
StatusMessage
(message_id, in_response_to, extended_headers=None, status_type=None, status_detail=None, message=None)[source]¶ A TAXII Status message.
Parameters: - message_id (str) – A value identifying this message. Required
- in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- status_type (str) – One of the defined Status Types or a third-party- defined Status Type. Required
- status_detail (str) – A field for additional information about
this status in a machine-readable format. Optional or Prohibited
depending on
status_type
. See TAXII Specification for details. - message (str) – Additional information for the status. There is no expectation that this field be interpretable by a machine; it is instead targeted to a human operator. Optional
Example:
status_message1 = tm10.StatusMessage(
message_id=tm10.generate_message_id(),
in_response_to="12345",
status_type=ST_SUCCESS,
status_detail='Machine-processable info here!',
message='This is a message.')
Discovery Request¶
-
class
libtaxii.messages_10.
DiscoveryRequest
(message_id, in_response_to=None, extended_headers=None)[source]¶ A TAXII Discovery Request message.
Parameters:
Example:
ext_headers = {'name1': 'val1', 'name2': 'val2'}
discovery_request = tm10.DiscoveryRequest(
message_id=tm10.generate_message_id(),
extended_headers=ext_headers)
Discovery Response¶
-
class
libtaxii.messages_10.
DiscoveryResponse
(message_id, in_response_to, extended_headers=None, service_instances=None)[source]¶ A TAXII Discovery Response message.
Parameters: - message_id (str) – A value identifying this message. Required
- in_response_to (str) – Contains the Message ID of the message to which this is a response. Optional
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- service_instances (list of ServiceInstance) – a list of service instances that this response contains. Optional
-
class
libtaxii.messages_10.
ServiceInstance
(service_type, services_version, protocol_binding, service_address, message_bindings, inbox_service_accepted_content=None, available=None, message=None)[source]¶ The Service Instance component of a TAXII Discovery Response Message.
Parameters: - service_type (string) – identifies the Service Type of this Service Instance. Required
- services_version (string) – identifies the TAXII Services Specification to which this Service conforms. Required
- protocol_binding (string) – identifies the protocol binding supported by this Service. Required
- service_address (string) – identifies the network address of the TAXII Daemon that hosts this Service. Required
- message_bindings (list of strings) – identifies the message bindings supported by this Service instance. Required
- inbox_service_accepted_content (list of strings) – identifies content bindings that this Inbox Service is willing to accept. Optional
- available (boolean) – indicates whether the identity of the requester (authenticated or otherwise) is allowed to access this TAXII Service. Optional
- message (string) – contains a message regarding this Service instance. Optional
The
message_bindings
list must contain at least one value.
Example:
discovery_response = tm10.DiscoveryResponse(
message_id=tm10.generate_message_id(),
in_response_to=discovery_request.message_id)
service_instance = tm10.ServiceInstance(
service_type=SVC_INBOX,
services_version=VID_TAXII_SERVICES_10,
protocol_binding=VID_TAXII_HTTPS_10,
service_address='https://example.com/inbox/',
message_bindings=[VID_TAXII_XML_10],
inbox_service_accepted_content=[CB_STIX_XML_10],
available=True,
message='This is a sample inbox service instance')
discovery_response.service_instances.append(service_instance)
# Alternatively, you could define the service instance(s) first and use the
# following:
service_instance_list = [service_instance]
discovery_response = tm10.DiscoveryResponse(
message_id=tm10.generate_message_id(),
in_response_to=discovery_request.message_id,
service_instances=service_instance_list)
Feed Information Request¶
-
class
libtaxii.messages_10.
FeedInformationRequest
(message_id, in_response_to=None, extended_headers=None)[source]¶ A TAXII Feed Information Request message.
Parameters:
Example:
ext_headers = {'name1': 'val1', 'name2': 'val2'}
feed_information_request= tm10.FeedInformationRequest(
message_id=tm10.generate_message_id(),
extended_headers=ext_headers)
Feed Information Response¶
-
class
libtaxii.messages_10.
FeedInformationResponse
(message_id, in_response_to, extended_headers=None, feed_informations=None)[source]¶ A TAXII Feed Information Response message.
Parameters: - message_id (str) – A value identifying this message. Required
- in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- feed_informations (list of FeedInformation) – A list of FeedInformation objects to be contained in this response. Optional
-
class
libtaxii.messages_10.
FeedInformation
(feed_name, feed_description, supported_contents, available=None, push_methods=None, polling_service_instances=None, subscription_methods=None)[source]¶ The Feed Information component of a TAXII Feed Information Response Message.
Parameters: - feed_name (str) – the name by which this TAXII Data Feed is identified. Required
- feed_description (str) – a prose description of this TAXII Data Feed. Required
- supported_contents (list of str) – Content Binding IDs indicating which types of content are currently expressed in this TAXII Data Feed. Required
- available (boolean) – whether the identity of the requester
(authenticated or otherwise) is allowed to access this TAXII
Service. Optional Default:
None
, indicating “unknown” - push_methods (list of PushMethod objects) – the protocols that can be used to push content via a subscription. Optional
- polling_service_instances (list of PollingServiceInstance objects) – the bindings and address a Consumer can use to interact with a Poll Service instance that supports this TAXII Data Feed. Optional
- subscription_methods (list of SubscriptionMethod objects) – the protocol and address of the TAXII Daemon hosting the Feed Management Service that can process subscriptions for this TAXII Data Feed. Optional
The absense of
push_methods
indicates no push methods. The absense ofpolling_service_instances
indicates no polling services. At least one ofpush_methods
andpolling_service_instances
must not be empty. The absense ofsubscription_methods
indicates no subscription services.
-
class
libtaxii.messages_10.
PushMethod
(push_protocol, push_message_bindings)[source]¶ The Push Method component of a TAXII Feed Information component.
Parameters: - push_protocol (str) – a protocol binding that can be used to push content to an Inbox Service instance. Required
- push_message_bindings (list of str) – the message bindings that can be used to push content to an Inbox Service instance using the protocol identified in the Push Protocol field. Required
-
class
libtaxii.messages_10.
PollingServiceInstance
(poll_protocol, poll_address, poll_message_bindings)[source]¶ The Polling Service Instance component of a TAXII Feed Information component.
Parameters:
-
class
libtaxii.messages_10.
SubscriptionMethod
(subscription_protocol, subscription_address, subscription_message_bindings)[source]¶ The Subscription Method component of a TAXII Feed Information component.
Parameters: - subscription_protocol (str) – the protocol binding supported by this Feed Management Service instance. Required
- subscription_address (str) – the address of the TAXII Daemon hosting this Feed Management Service instance. Required.
- subscription_message_bindings (list of str) – the message bindings supported by this Feed Management Service Instance. Required
Example:
push_method1 = tm10.PushMethod(
push_protocol=VID_TAXII_HTTP_10,
push_message_bindings=[VID_TAXII_XML_10])
polling_service1 = tm10.PollingServiceInstance(
poll_protocol=VID_TAXII_HTTP_10,
poll_address='http://example.com/PollService/',
poll_message_bindings=[VID_TAXII_XML_10])
subscription_service1 = tm10.SubscriptionMethod(
subscription_protocol=VID_TAXII_HTTP_10,
subscription_address='http://example.com/SubsService/',
subscription_message_bindings=[VID_TAXII_XML_10])
feed1 = tm10.FeedInformation(
feed_name='Feed1',
feed_description='Description of a feed',
supported_contents=[CB_STIX_XML_10],
available=True,
push_methods=[push_method1],
polling_service_instances=[polling_service1],
subscription_methods=[subscription_service1])
feed_information_response1 = tm10.FeedInformationResponse(
message_id=tm10.generate_message_id(),
in_response_to=tm10.generate_message_id(),
feed_informations=[feed1])
Manage Feed Subscription Request¶
-
class
libtaxii.messages_10.
ManageFeedSubscriptionRequest
(message_id, extended_headers=None, feed_name=None, action=None, subscription_id=None, delivery_parameters=None)[source]¶ A TAXII Manage Feed Subscription Request message.
Parameters: - message_id (str) – A value identifying this message. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
- action (str) – the requested action to take. Required
- subscription_id (str) – the ID of a previously created subscription.
Required if
action==
ACT_UNSUBSCRIBE
, else Prohibited. - delivery_parameters (list of DeliveryParameters) – the delivery parameters for this request. Optional Absence means delivery is not requested.
Example:
delivery_parameters1 = tm10.DeliveryParameters(
inbox_protocol=VID_TAXII_HTTP_10,
inbox_address='http://example.com/inbox',
delivery_message_binding=VID_TAXII_XML_10,
content_bindings=[CB_STIX_XML_10])
manage_feed_subscription_request1 = tm10.ManageFeedSubscriptionRequest(
message_id=tm10.generate_message_id(),
feed_name='SomeFeedName',
action=ACT_UNSUBSCRIBE,
subscription_id='SubsId056',
delivery_parameters=delivery_parameters1)
Manage Feed Subscription Response¶
-
class
libtaxii.messages_10.
ManageFeedSubscriptionResponse
(message_id, in_response_to, extended_headers=None, feed_name=None, message=None, subscription_instances=None)[source]¶ A TAXII Manage Feed Subscription Response message.
Parameters: - message_id (str) – A value identifying this message. Required
- in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
- message (str) – additional information for the message recipient. Optional
- subscription_instances (list of SubscriptionInstance) – Optional
-
class
libtaxii.messages_10.
SubscriptionInstance
(subscription_id, delivery_parameters=None, poll_instances=None)[source]¶ The Subscription Instance component of the Manage Feed Subscription Response message.
Parameters: - subscription_id (str) – the id of the subscription. Required
- delivery_parameters (libtaxii.messages_10.DeliveryParameters) – the parameters
for this subscription. Required if responding to message
with
action==
ACT_STATUS
, otherwise Prohibited - poll_instances (list of PollInstance) – Each Poll Instance represents an instance of a Poll Service that can be contacted to retrieve content associated with the new Subscription. Optional
-
class
libtaxii.messages_10.
PollInstance
(poll_protocol, poll_address, poll_message_bindings=None)[source]¶ The Poll Instance component of the Manage Feed Subscription Response message.
Parameters: - poll_protocol (str) – The protocol binding supported by this instance of a Polling Service. Required
- poll_address (str) – the address of the TAXII Daemon hosting this Poll Service. Required
- poll_message_bindings (list of str) – one or more message bindings that can be used when interacting with this Poll Service instance. Required
Example:
poll_instance1 = tm10.PollInstance(
poll_protocol=VID_TAXII_HTTP_10,
poll_address='http://example.com/poll',
poll_message_bindings=[VID_TAXII_XML_10])
subscription_instance1 = tm10.SubscriptionInstance(
subscription_id='SubsId234',
delivery_parameters=[delivery_parameters1],
poll_instances=[poll_instance1])
manage_feed_subscription_response1 = tm10.ManageFeedSubscriptionResponse(
message_id=tm10.generate_message_id(),
in_response_to="12345",
feed_name='Feed001',
message='This is a message',
subscription_instances=[subscription_instance1])
Poll Request¶
-
class
libtaxii.messages_10.
PollRequest
(message_id, extended_headers=None, feed_name=None, exclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, content_bindings=None)[source]¶ A TAXII Poll Request message.
Parameters: - message_id (str) – A value identifying this message. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- feed_name (str) – the name of the TAXII Data Feed that is being polled. Required
- exclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range of TAXII Data Feed content the requester wishes to receive. Optional
- inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range of TAXII Data Feed content the requester wishes to receive. Optional
- subscription_id (str) – the existing subscription the Consumer wishes to poll. Optional
- content_bindings (list of str) – the type of content that is requested in the response to this poll. Optional, defaults to accepting all content bindings.
Example:
poll_request1 = tm10.PollRequest(
message_id=tm10.generate_message_id(),
feed_name='TheFeedToPoll',
exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
subscription_id='SubsId002',
content_bindings=[CB_STIX_XML_10])
Poll Response¶
-
class
libtaxii.messages_10.
PollResponse
(message_id, in_response_to, extended_headers=None, feed_name=None, inclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, message=None, content_blocks=None)[source]¶ A TAXII Poll Response message.
Parameters: - message_id (str) – A value identifying this message. Required
- in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- feed_name (str) – the name of the TAXII Data Feed that was polled. Required
- inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range this response covers. Optional
- inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range this response covers. Required
- subscription_id (str) – the Subscription ID for which this content is being provided. Optional
- message (str) – additional information for the message recipient. Optional
- content_blocks (list of ContentBlock) – piece of content and additional information related to the content. Optional
Example:
poll_response1 = tm10.PollResponse(
message_id=tm10.generate_message_id(),
in_response_to="12345",
feed_name='FeedName',
inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
subscription_id='SubsId001',
message='This is a message.',
content_blocks=[])
Inbox Message¶
-
class
libtaxii.messages_10.
InboxMessage
(message_id, in_response_to=None, extended_headers=None, message=None, subscription_information=None, content_blocks=None)[source]¶ A TAXII Inbox message.
Parameters: - message_id (str) – A value identifying this message. Required
- extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
- message (str) – prose information for the message recipient. Optional
- subscription_information (libtaxii.messages_10.SubscriptionInformation) – This field is only present if this message is being sent to provide content in accordance with an existing TAXII Data Feed subscription. Optional
- content_blocks (list of ContentBlock) – Inbox content. Optional
-
class
libtaxii.messages_10.
SubscriptionInformation
(feed_name, subscription_id, inclusive_begin_timestamp_label, inclusive_end_timestamp_label)[source]¶ The Subscription Information component of a TAXII Inbox message.
Parameters: - feed_name (str) – the name of the TAXII Data Feed from which this content is being provided. Required
- subscription_id (str) – the Subscription ID for which this content is being provided. Required
- inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the time range this Inbox Message covers. Optional
- inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the time range this Inbox Message covers. Optional
Example:
cb1 = tm10.ContentBlock(CB_STIX_XML_11, "")
subscription_information1 = tm10.SubscriptionInformation(
feed_name='SomeFeedName',
subscription_id='SubsId021',
inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()))
inbox_message1 = tm10.InboxMessage(
message_id=tm10.generate_message_id(),
message='This is a message.',
subscription_information=subscription_information1,
content_blocks=[cb1])
Other Classes¶
-
class
libtaxii.messages_10.
TAXIIMessage
(message_id, in_response_to=None, extended_headers=None)[source]¶ Encapsulate properties common to all TAXII Messages (such as headers).
This class is extended by each Message Type (e.g., DiscoveryRequest), with each subclass containing subclass-specific information
-
class
libtaxii.messages_10.
ContentBlock
(content_binding, content, timestamp_label=None, padding=None)[source]¶ A TAXII Content Block.
Parameters: - content_binding (str) – a Content Binding ID or nesting expression indicating the type of content contained in the Content field of this Content Block. Required
- content (string or etree) – a piece of content of the type specified by the Content Binding. Required
- timestamp_label (datetime) – the Timestamp Label associated with this Content Block. Optional
- padding (string) – an arbitrary amount of padding for this Content Block. Optional
Example:
cb1 = tm10.ContentBlock(
content_binding=CB_STIX_XML_10,
content='<stix:STIX_Package xmlns:stix="http://stix.mitre.org/stix-1"/>')
-
class
libtaxii.messages_10.
DeliveryParameters
(inbox_protocol=None, inbox_address=None, delivery_message_binding=None, content_bindings=None)[source]¶ Delivery Parameters.
Parameters: - inbox_protocol (str) – identifies the protocol to be used when pushing TAXII Data Feed content to a Consumer’s TAXII Inbox Service implementation. Required
- inbox_address (str) – identifies the address of the TAXII Daemon hosting the Inbox Service to which the Consumer requests content for this TAXII Data Feed to be delivered. Required
- delivery_message_binding (str) – identifies the message binding to be used to send pushed content for this subscription. Required
- content_bindings (list of str) – contains Content Binding IDs indicating which types of contents the Consumer requests to receive for this TAXII Data Feed. Optional
Functions¶
-
libtaxii.messages_10.
generate_message_id
(maxlen=5, version=’urn:taxii.mitre.org:services:1.0’)[source]¶ Generate a TAXII Message ID.
Parameters: maxlen (int) – maximum length of the ID, in characters Example
msg_id = tm11.generate_message_id() message = tm11.DiscoveryRequest(msg_id) # Or... message = tm11.DiscoveryRequest(tm11.generate_message_id())
-
libtaxii.messages_10.
validate_xml
(xml_string)[source]¶ Note that this function has been deprecated. Please see libtaxii.validators.SchemaValidator.
Validate XML with the TAXII XML Schema 1.0.
Parameters: xml_string (str) – The XML to validate. Example
is_valid = tm10.validate_xml(message.to_xml())
-
libtaxii.messages_10.
get_message_from_xml
(xml_string, encoding=’utf_8’)[source]¶ Create a TAXIIMessage object from an XML string.
This function automatically detects which type of Message should be created based on the XML.
Parameters: xml_string (str) – The XML to parse into a TAXII message. Example
message_xml = message.to_xml() new_message = tm10.get_message_from_xml(message_xml)
-
libtaxii.messages_10.
get_message_from_dict
(d)[source]¶ Create a TAXIIMessage object from a dictonary.
This function automatically detects which type of Message should be created based on the ‘message_type’ key in the dictionary.
Parameters: d (dict) – The dictionary to build the TAXII message from. Example
message_dict = message.to_dict() new_message = tm10.get_message_from_dict(message_dict)