Struct Collection

pub struct Collection { /* private fields */ }

An immutable collection of STIX objects.

A collection has no special meaning beyond being a set of STIX objects all loaded in memory at once.

Usage

Create a Collection by deserializing JSON into Bundle instances and then adding those to a CollectionBuilder. Once all bundles are loaded, call CollectionBuilder::build to finish the collection, which will index the objects and prepare the collection for querying.

Implementations

impl Collection

pub fn builder() -> CollectionBuilder

Create a new CollectionBuilder.

pub fn get<'id, 'a: 'id, D>(&'a self, id: &'id Id) -> Option<Node<'a, D>>

where Ref<'id, 'a, D>: Resolve<Output = Node<'a, D>>,

Get the object identified by id if it is present in the collection. This function returns a Node which provides access to the object’s data and its relationships within the collection.

Examples found in repository

examples/tools.rs (line 12)

fn main() {
    let enterprise = attck::enterprise();
    let mimikatz_id = "tool--afc079f3-c0ea-4096-b75d-3f05338b7f60"
        .parse::<Id>()
        .unwrap();

    // Knowing the ID and the expected return type, request the resource from the
    // collection.
    let mimikatz = enterprise.get::<Tool>(&mimikatz_id).unwrap();

    println!(
        "{} {}",
        mimikatz.name(),
        mimikatz.description().unwrap_or("<NO DESCRIPTION>")
    );
}

examples/print_matrix.rs (line 34)

    pub fn new(matrix: Node<'a, Matrix>) -> Self {
        let collection = matrix.collection();
        // Annoyingly, MITRE does not publish SROs from tactics to techniques and instead relies on
        // the kill_chain_phases property. The `stix` crate doesn't know about this relationship, so
        // we do one pass to gather all the tactics and visit every attack_pattern to build the grid.
        let mut tactics_by_shortname = HashMap::new();

        // Cells are ordered to preserve the ordering from the Matrix declaration.
        let mut columns = vec![];

        let mut dangling_ids = BTreeSet::new();

        for tactic_ref in &matrix.data().tactic_refs {
            if let Some(tactic) = collection.get::<Tactic>(tactic_ref) {
                // Use data() because &tactic.shortname doesn't live long enough
                tactics_by_shortname.insert(&tactic.data().shortname, columns.len());
                // Insert _after_ capturing the index of the value we just added or else our
                // indices will be off by one.
                columns.push((tactic.data(), vec![]));
            } else {
                dangling_ids.insert(tactic_ref);
            }
        }

        for attack_pattern in matrix
            .collection()
            .attack_patterns()
            .filter(|ap| ap.mitre.is_subtechnique == Some(false))
        {
            for phase in attack_pattern
                .base
                .kill_chain_phases
                .iter()
                .filter(|phase| phase.kill_chain_name == "mitre-attack")
            {
                if let Some(cell_index) = tactics_by_shortname.get(&phase.phase_name).copied() {
                    columns[cell_index].1.push(attack_pattern.clone());
                }
            }
        }

        Self {
            columns,
            dangling_ids,
        }
    }

pub fn is_empty(&self) -> bool

Get whether the collection has no items.

pub fn len(&self) -> usize

Get the number of objects in the collection.

impl Collection

Accessors for STIX objects in the collection.

pub fn attack_patterns<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, AttackPattern>>

Examples found in repository

examples/data_sources.rs (line 10)

fn main() {
    let enterprise = attck::enterprise();

    let data_sources = enterprise
        .attack_patterns()
        .flat_map(|ap| &ap.data().mitre.data_sources)
        .collect::<BTreeSet<_>>();

    for data_source in data_sources {
        println!("{}", data_source);
    }
}

examples/print_matrix.rs (line 47)

    pub fn new(matrix: Node<'a, Matrix>) -> Self {
        let collection = matrix.collection();
        // Annoyingly, MITRE does not publish SROs from tactics to techniques and instead relies on
        // the kill_chain_phases property. The `stix` crate doesn't know about this relationship, so
        // we do one pass to gather all the tactics and visit every attack_pattern to build the grid.
        let mut tactics_by_shortname = HashMap::new();

        // Cells are ordered to preserve the ordering from the Matrix declaration.
        let mut columns = vec![];

        let mut dangling_ids = BTreeSet::new();

        for tactic_ref in &matrix.data().tactic_refs {
            if let Some(tactic) = collection.get::<Tactic>(tactic_ref) {
                // Use data() because &tactic.shortname doesn't live long enough
                tactics_by_shortname.insert(&tactic.data().shortname, columns.len());
                // Insert _after_ capturing the index of the value we just added or else our
                // indices will be off by one.
                columns.push((tactic.data(), vec![]));
            } else {
                dangling_ids.insert(tactic_ref);
            }
        }

        for attack_pattern in matrix
            .collection()
            .attack_patterns()
            .filter(|ap| ap.mitre.is_subtechnique == Some(false))
        {
            for phase in attack_pattern
                .base
                .kill_chain_phases
                .iter()
                .filter(|phase| phase.kill_chain_name == "mitre-attack")
            {
                if let Some(cell_index) = tactics_by_shortname.get(&phase.phase_name).copied() {
                    columns[cell_index].1.push(attack_pattern.clone());
                }
            }
        }

        Self {
            columns,
            dangling_ids,
        }
    }

pub fn courses_of_action<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, CourseOfAction>>

pub fn malware<'a>(&'a self) -> impl Iterator<Item = Node<'a, Malware>>

pub fn matrices<'a>(&'a self) -> impl Iterator<Item = Node<'a, Matrix>>

Examples found in repository

examples/print_matrix.rs (line 98)

fn main() {
    let enterprise = attck::enterprise();

    for matrix in enterprise.matrices() {
        println!("===== {} =====", matrix.name);
        let disp = DisplayMatrix::new(matrix);
        println!("{}", disp);
        for id in &disp.dangling_ids {
            eprintln!("Found reference to {} but it was not in the collection", id);
        }
    }
}

pub fn tactics<'a>(&'a self) -> impl Iterator<Item = Node<'a, Tactic>>

pub fn tools<'a>(&'a self) -> impl Iterator<Item = Node<'a, Tool>>

pub fn campaigns<'a>(&'a self) -> impl Iterator<Item = Node<'a, Campaign>>

pub fn identities<'a>(&'a self) -> impl Iterator<Item = Node<'a, Identity>>

pub fn intrusion_sets<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, IntrusionSet>>

Examples found in repository

examples/actor_lookup.rs (line 47)

fn search<'store>(store: &'store Collection, term: &str) -> Option<Node<'store, IntrusionSet>> {
    store
        .intrusion_sets()
        .find(|a| a.name() == term || a.aliases().contains(term))
}

pub fn infrastructure<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, Infrastructure>>

pub fn locations<'a>(&'a self) -> impl Iterator<Item = Node<'a, Location>>

pub fn marking_definitions<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, MarkingDefinition>>

pub fn relationships<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, Relationship>>

pub fn threat_actors<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, ThreatActor>>

pub fn vulnerabilities<'a>( &'a self, ) -> impl Iterator<Item = Node<'a, Vulnerability>>

Trait Implementations

impl From<Bundle<Declaration>> for Collection

fn from(bundle: Bundle<Declaration>) -> Self

Converts to this type from the input type.