Version: 1.1.119
libtaxii.messages_10
Module¶
Creating, handling, and parsing TAXII 1.0 messages.
Note
The examples on this page assume that you have run the equivalent of
import datetime
from dateutil.tz import tzutc
import libtaxii as t
import libtaxii.messages_10 as tm10
from libtaxii.constants import *
Status Message¶
- class libtaxii.messages_10.StatusMessage(message_id, in_response_to, extended_headers=None, status_type=None, status_detail=None, message=None)[source]¶
A TAXII Status message.
- Parameters:
message_id (str) – A value identifying this message. Required
in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
status_type (str) – One of the defined Status Types or a third-party- defined Status Type. Required
status_detail (str) – A field for additional information about this status in a machine-readable format. Optional or Prohibited depending on
status_type
. See TAXII Specification for details.message (str) – Additional information for the status. There is no expectation that this field be interpretable by a machine; it is instead targeted to a human operator. Optional
Example:
status_message1 = tm10.StatusMessage(
message_id=tm10.generate_message_id(),
in_response_to="12345",
status_type=ST_SUCCESS,
status_detail='Machine-processable info here!',
message='This is a message.')
Discovery Request¶
- class libtaxii.messages_10.DiscoveryRequest(message_id, in_response_to=None, extended_headers=None)[source]¶
A TAXII Discovery Request message.
- Parameters:
message_id (str) – A value identifying this message. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
Example:
ext_headers = {'name1': 'val1', 'name2': 'val2'}
discovery_request = tm10.DiscoveryRequest(
message_id=tm10.generate_message_id(),
extended_headers=ext_headers)
Discovery Response¶
- class libtaxii.messages_10.DiscoveryResponse(message_id, in_response_to, extended_headers=None, service_instances=None)[source]¶
A TAXII Discovery Response message.
- Parameters:
message_id (str) – A value identifying this message. Required
in_response_to (str) – Contains the Message ID of the message to which this is a response. Optional
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
service_instances (list of ServiceInstance) – a list of service instances that this response contains. Optional
- class libtaxii.messages_10.ServiceInstance(service_type, services_version, protocol_binding, service_address, message_bindings, inbox_service_accepted_content=None, available=None, message=None)[source]¶
The Service Instance component of a TAXII Discovery Response Message.
- Parameters:
service_type (string) – identifies the Service Type of this Service Instance. Required
services_version (string) – identifies the TAXII Services Specification to which this Service conforms. Required
protocol_binding (string) – identifies the protocol binding supported by this Service. Required
service_address (string) – identifies the network address of the TAXII Daemon that hosts this Service. Required
message_bindings (list of strings) – identifies the message bindings supported by this Service instance. Required
inbox_service_accepted_content (list of strings) – identifies content bindings that this Inbox Service is willing to accept. Optional
available (boolean) – indicates whether the identity of the requester (authenticated or otherwise) is allowed to access this TAXII Service. Optional
message (string) – contains a message regarding this Service instance. Optional
The
message_bindings
list must contain at least one value.
Example:
discovery_response = tm10.DiscoveryResponse(
message_id=tm10.generate_message_id(),
in_response_to=discovery_request.message_id)
service_instance = tm10.ServiceInstance(
service_type=SVC_INBOX,
services_version=VID_TAXII_SERVICES_10,
protocol_binding=VID_TAXII_HTTPS_10,
service_address='https://example.com/inbox/',
message_bindings=[VID_TAXII_XML_10],
inbox_service_accepted_content=[CB_STIX_XML_10],
available=True,
message='This is a sample inbox service instance')
discovery_response.service_instances.append(service_instance)
# Alternatively, you could define the service instance(s) first and use the
# following:
service_instance_list = [service_instance]
discovery_response = tm10.DiscoveryResponse(
message_id=tm10.generate_message_id(),
in_response_to=discovery_request.message_id,
service_instances=service_instance_list)
Feed Information Request¶
- class libtaxii.messages_10.FeedInformationRequest(message_id, in_response_to=None, extended_headers=None)[source]¶
A TAXII Feed Information Request message.
- Parameters:
message_id (str) – A value identifying this message. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
Example:
ext_headers = {'name1': 'val1', 'name2': 'val2'}
feed_information_request= tm10.FeedInformationRequest(
message_id=tm10.generate_message_id(),
extended_headers=ext_headers)
Feed Information Response¶
- class libtaxii.messages_10.FeedInformationResponse(message_id, in_response_to, extended_headers=None, feed_informations=None)[source]¶
A TAXII Feed Information Response message.
- Parameters:
message_id (str) – A value identifying this message. Required
in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
feed_informations (list of FeedInformation) – A list of FeedInformation objects to be contained in this response. Optional
- class libtaxii.messages_10.FeedInformation(feed_name, feed_description, supported_contents, available=None, push_methods=None, polling_service_instances=None, subscription_methods=None)[source]¶
The Feed Information component of a TAXII Feed Information Response Message.
- Parameters:
feed_name (str) – the name by which this TAXII Data Feed is identified. Required
feed_description (str) – a prose description of this TAXII Data Feed. Required
supported_contents (list of str) – Content Binding IDs indicating which types of content are currently expressed in this TAXII Data Feed. Required
available (boolean) – whether the identity of the requester (authenticated or otherwise) is allowed to access this TAXII Service. Optional Default:
None
, indicating “unknown”push_methods (list of PushMethod objects) – the protocols that can be used to push content via a subscription. Optional
polling_service_instances (list of PollingServiceInstance objects) – the bindings and address a Consumer can use to interact with a Poll Service instance that supports this TAXII Data Feed. Optional
subscription_methods (list of SubscriptionMethod objects) – the protocol and address of the TAXII Daemon hosting the Feed Management Service that can process subscriptions for this TAXII Data Feed. Optional
The absense of
push_methods
indicates no push methods. The absense ofpolling_service_instances
indicates no polling services. At least one ofpush_methods
andpolling_service_instances
must not be empty. The absense ofsubscription_methods
indicates no subscription services.
- class libtaxii.messages_10.PushMethod(push_protocol, push_message_bindings)[source]¶
The Push Method component of a TAXII Feed Information component.
- Parameters:
push_protocol (str) – a protocol binding that can be used to push content to an Inbox Service instance. Required
push_message_bindings (list of str) – the message bindings that can be used to push content to an Inbox Service instance using the protocol identified in the Push Protocol field. Required
- class libtaxii.messages_10.PollingServiceInstance(poll_protocol, poll_address, poll_message_bindings)[source]¶
The Polling Service Instance component of a TAXII Feed Information component.
- Parameters:
poll_protocol (str) – the protocol binding supported by this Poll Service instance. Required
poll_address (str) – the address of the TAXII Daemon hosting this Poll Service instance. Required
poll_message_bindings (list of str) – the message bindings supported by this Poll Service instance. Required
- class libtaxii.messages_10.SubscriptionMethod(subscription_protocol, subscription_address, subscription_message_bindings)[source]¶
The Subscription Method component of a TAXII Feed Information component.
- Parameters:
subscription_protocol (str) – the protocol binding supported by this Feed Management Service instance. Required
subscription_address (str) – the address of the TAXII Daemon hosting this Feed Management Service instance. Required.
subscription_message_bindings (list of str) – the message bindings supported by this Feed Management Service Instance. Required
Example:
push_method1 = tm10.PushMethod(
push_protocol=VID_TAXII_HTTP_10,
push_message_bindings=[VID_TAXII_XML_10])
polling_service1 = tm10.PollingServiceInstance(
poll_protocol=VID_TAXII_HTTP_10,
poll_address='http://example.com/PollService/',
poll_message_bindings=[VID_TAXII_XML_10])
subscription_service1 = tm10.SubscriptionMethod(
subscription_protocol=VID_TAXII_HTTP_10,
subscription_address='http://example.com/SubsService/',
subscription_message_bindings=[VID_TAXII_XML_10])
feed1 = tm10.FeedInformation(
feed_name='Feed1',
feed_description='Description of a feed',
supported_contents=[CB_STIX_XML_10],
available=True,
push_methods=[push_method1],
polling_service_instances=[polling_service1],
subscription_methods=[subscription_service1])
feed_information_response1 = tm10.FeedInformationResponse(
message_id=tm10.generate_message_id(),
in_response_to=tm10.generate_message_id(),
feed_informations=[feed1])
Manage Feed Subscription Request¶
- class libtaxii.messages_10.ManageFeedSubscriptionRequest(message_id, extended_headers=None, feed_name=None, action=None, subscription_id=None, delivery_parameters=None)[source]¶
A TAXII Manage Feed Subscription Request message.
- Parameters:
message_id (str) – A value identifying this message. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
action (str) – the requested action to take. Required
subscription_id (str) – the ID of a previously created subscription. Required if
action==
ACT_UNSUBSCRIBE
, else Prohibited.delivery_parameters (list of DeliveryParameters) – the delivery parameters for this request. Optional Absence means delivery is not requested.
Example:
delivery_parameters1 = tm10.DeliveryParameters(
inbox_protocol=VID_TAXII_HTTP_10,
inbox_address='http://example.com/inbox',
delivery_message_binding=VID_TAXII_XML_10,
content_bindings=[CB_STIX_XML_10])
manage_feed_subscription_request1 = tm10.ManageFeedSubscriptionRequest(
message_id=tm10.generate_message_id(),
feed_name='SomeFeedName',
action=ACT_UNSUBSCRIBE,
subscription_id='SubsId056',
delivery_parameters=delivery_parameters1)
Manage Feed Subscription Response¶
- class libtaxii.messages_10.ManageFeedSubscriptionResponse(message_id, in_response_to, extended_headers=None, feed_name=None, message=None, subscription_instances=None)[source]¶
A TAXII Manage Feed Subscription Response message.
- Parameters:
message_id (str) – A value identifying this message. Required
in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
feed_name (str) – the name of the TAXII Data Feed to which the action applies. Required
message (str) – additional information for the message recipient. Optional
subscription_instances (list of SubscriptionInstance) – Optional
- class libtaxii.messages_10.SubscriptionInstance(subscription_id, delivery_parameters=None, poll_instances=None)[source]¶
The Subscription Instance component of the Manage Feed Subscription Response message.
- Parameters:
subscription_id (str) – the id of the subscription. Required
delivery_parameters (libtaxii.messages_10.DeliveryParameters) – the parameters for this subscription. Required if responding to message with
action==
ACT_STATUS
, otherwise Prohibitedpoll_instances (list of PollInstance) – Each Poll Instance represents an instance of a Poll Service that can be contacted to retrieve content associated with the new Subscription. Optional
- class libtaxii.messages_10.PollInstance(poll_protocol, poll_address, poll_message_bindings=None)[source]¶
The Poll Instance component of the Manage Feed Subscription Response message.
- Parameters:
poll_protocol (str) – The protocol binding supported by this instance of a Polling Service. Required
poll_address (str) – the address of the TAXII Daemon hosting this Poll Service. Required
poll_message_bindings (list of str) – one or more message bindings that can be used when interacting with this Poll Service instance. Required
Example:
poll_instance1 = tm10.PollInstance(
poll_protocol=VID_TAXII_HTTP_10,
poll_address='http://example.com/poll',
poll_message_bindings=[VID_TAXII_XML_10])
subscription_instance1 = tm10.SubscriptionInstance(
subscription_id='SubsId234',
delivery_parameters=[delivery_parameters1],
poll_instances=[poll_instance1])
manage_feed_subscription_response1 = tm10.ManageFeedSubscriptionResponse(
message_id=tm10.generate_message_id(),
in_response_to="12345",
feed_name='Feed001',
message='This is a message',
subscription_instances=[subscription_instance1])
Poll Request¶
- class libtaxii.messages_10.PollRequest(message_id, extended_headers=None, feed_name=None, exclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, content_bindings=None)[source]¶
A TAXII Poll Request message.
- Parameters:
message_id (str) – A value identifying this message. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
feed_name (str) – the name of the TAXII Data Feed that is being polled. Required
exclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range of TAXII Data Feed content the requester wishes to receive. Optional
inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range of TAXII Data Feed content the requester wishes to receive. Optional
subscription_id (str) – the existing subscription the Consumer wishes to poll. Optional
content_bindings (list of str) – the type of content that is requested in the response to this poll. Optional, defaults to accepting all content bindings.
Example:
poll_request1 = tm10.PollRequest(
message_id=tm10.generate_message_id(),
feed_name='TheFeedToPoll',
exclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
subscription_id='SubsId002',
content_bindings=[CB_STIX_XML_10])
Poll Response¶
- class libtaxii.messages_10.PollResponse(message_id, in_response_to, extended_headers=None, feed_name=None, inclusive_begin_timestamp_label=None, inclusive_end_timestamp_label=None, subscription_id=None, message=None, content_blocks=None)[source]¶
A TAXII Poll Response message.
- Parameters:
message_id (str) – A value identifying this message. Required
in_response_to (str) – Contains the Message ID of the message to which this is a response. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
feed_name (str) – the name of the TAXII Data Feed that was polled. Required
inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the range this response covers. Optional
inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the range this response covers. Required
subscription_id (str) – the Subscription ID for which this content is being provided. Optional
message (str) – additional information for the message recipient. Optional
content_blocks (list of ContentBlock) – piece of content and additional information related to the content. Optional
Example:
poll_response1 = tm10.PollResponse(
message_id=tm10.generate_message_id(),
in_response_to="12345",
feed_name='FeedName',
inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()),
subscription_id='SubsId001',
message='This is a message.',
content_blocks=[])
Inbox Message¶
- class libtaxii.messages_10.InboxMessage(message_id, in_response_to=None, extended_headers=None, message=None, subscription_information=None, content_blocks=None)[source]¶
A TAXII Inbox message.
- Parameters:
message_id (str) – A value identifying this message. Required
extended_headers (dict) – A dictionary of name/value pairs for use as Extended Headers. Optional
message (str) – prose information for the message recipient. Optional
subscription_information (libtaxii.messages_10.SubscriptionInformation) – This field is only present if this message is being sent to provide content in accordance with an existing TAXII Data Feed subscription. Optional
content_blocks (list of ContentBlock) – Inbox content. Optional
- class libtaxii.messages_10.SubscriptionInformation(feed_name, subscription_id, inclusive_begin_timestamp_label, inclusive_end_timestamp_label)[source]¶
The Subscription Information component of a TAXII Inbox message.
- Parameters:
feed_name (str) – the name of the TAXII Data Feed from which this content is being provided. Required
subscription_id (str) – the Subscription ID for which this content is being provided. Required
inclusive_begin_timestamp_label (datetime) – a Timestamp Label indicating the beginning of the time range this Inbox Message covers. Optional
inclusive_end_timestamp_label (datetime) – a Timestamp Label indicating the end of the time range this Inbox Message covers. Optional
Example:
cb1 = tm10.ContentBlock(CB_STIX_XML_11, "")
subscription_information1 = tm10.SubscriptionInformation(
feed_name='SomeFeedName',
subscription_id='SubsId021',
inclusive_begin_timestamp_label=datetime.datetime.now(tzutc()),
inclusive_end_timestamp_label=datetime.datetime.now(tzutc()))
inbox_message1 = tm10.InboxMessage(
message_id=tm10.generate_message_id(),
message='This is a message.',
subscription_information=subscription_information1,
content_blocks=[cb1])
Other Classes¶
- class libtaxii.messages_10.TAXIIMessage(message_id, in_response_to=None, extended_headers=None)[source]¶
Encapsulate properties common to all TAXII Messages (such as headers).
This class is extended by each Message Type (e.g., DiscoveryRequest), with each subclass containing subclass-specific information
- class libtaxii.messages_10.ContentBlock(content_binding, content, timestamp_label=None, padding=None)[source]¶
A TAXII Content Block.
- Parameters:
content_binding (str) – a Content Binding ID or nesting expression indicating the type of content contained in the Content field of this Content Block. Required
content (string or etree) – a piece of content of the type specified by the Content Binding. Required
timestamp_label (datetime) – the Timestamp Label associated with this Content Block. Optional
padding (string) – an arbitrary amount of padding for this Content Block. Optional
Example:
cb1 = tm10.ContentBlock(
content_binding=CB_STIX_XML_10,
content='<stix:STIX_Package xmlns:stix="http://stix.mitre.org/stix-1"/>')
- class libtaxii.messages_10.DeliveryParameters(inbox_protocol=None, inbox_address=None, delivery_message_binding=None, content_bindings=None)[source]¶
Delivery Parameters.
- Parameters:
inbox_protocol (str) – identifies the protocol to be used when pushing TAXII Data Feed content to a Consumer’s TAXII Inbox Service implementation. Required
inbox_address (str) – identifies the address of the TAXII Daemon hosting the Inbox Service to which the Consumer requests content for this TAXII Data Feed to be delivered. Required
delivery_message_binding (str) – identifies the message binding to be used to send pushed content for this subscription. Required
content_bindings (list of str) – contains Content Binding IDs indicating which types of contents the Consumer requests to receive for this TAXII Data Feed. Optional
Functions¶
- libtaxii.messages_10.generate_message_id(maxlen=5, version='urn:taxii.mitre.org:services:1.0')[source]¶
Generate a TAXII Message ID.
- Parameters:
maxlen (int) – maximum length of the ID, in characters
Example
msg_id = tm11.generate_message_id() message = tm11.DiscoveryRequest(msg_id) # Or... message = tm11.DiscoveryRequest(tm11.generate_message_id())
- libtaxii.messages_10.validate_xml(xml_string)[source]¶
Note that this function has been deprecated. Please see libtaxii.validators.SchemaValidator.
Validate XML with the TAXII XML Schema 1.0.
- Parameters:
xml_string (str) – The XML to validate.
Example
is_valid = tm10.validate_xml(message.to_xml())
- libtaxii.messages_10.get_message_from_xml(xml_string, encoding='utf_8')[source]¶
Create a TAXIIMessage object from an XML string.
This function automatically detects which type of Message should be created based on the XML.
- Parameters:
xml_string (str) – The XML to parse into a TAXII message.
Example
message_xml = message.to_xml() new_message = tm10.get_message_from_xml(message_xml)
- libtaxii.messages_10.get_message_from_dict(d)[source]¶
Create a TAXIIMessage object from a dictonary.
This function automatically detects which type of Message should be created based on the ‘message_type’ key in the dictionary.
- Parameters:
d (dict) – The dictionary to build the TAXII message from.
Example
message_dict = message.to_dict() new_message = tm10.get_message_from_dict(message_dict)