iodedeflib 0.07

如何解析IODEF数据

import iodeflib
# open XML file and parse IODEF:
iodef = iodeflib.parse_file('iodef.xml')
# print some attributes for each incident:
for incident in iodef.incidents:
    print 'Incident %s from %s - impact type: %s' % (incident.id,
        incident.id_name, incident.get_first_impact().type)
    for desc in incident.descriptions:
        print desc
    print 'Sources:'
    for system in incident.get_sources(): print system.get_addresses()
    print 'Targets:'
    for system in incident.get_targets(): print system.get_addresses()
    print ''

如何创建IODEF数据

import iodeflib
# create a new IODEF document:
iodef = iodeflib.IODEF_Document()
# create a new incident:
incident1 = iodeflib.Incident(id='1234', id_name='CSIRT-X',
    report_time='2011-09-13T11:01:00+00:00',
    start_time='2011-09-13T10:19:24+00:00')
# add description:
incident1.descriptions = ['Detected denial of service attack']
# add sources and targets:
incident1.add_system(category='source', address='192.168.1.2')
incident1.add_system(category='target', address='192.168.3.7', name='XYZ')
# add impact assessment:
incident1.add_impact(description='DoS on system XYZ', type='dos',
    severity='medium', completion='succeeded', occurence='actual',
    restriction='need-to-know')
iodef.incidents.append(incident1)
# serialize IODEF to XML, print it and save it to a file:
print iodef
open('iodef2.xml', 'w').write(str(iodef))

如何编辑IODEF数据

# open XML file and parse IODEF:
iodef = iodeflib.parse_file('iodef2.xml')
# get incident, add end time and history item:
incident1 = iodef.incidents[0]
histitem = iodeflib.HistoryItem(descriptions=['Blocked source IP.'],
    datetime='2011-09-13T13:47:12+00:00')
incident1.history.append(histitem)
incident1.end_time='2011-09-13T13:47:12+00:00'
incident1.report_time='2011-09-13T13:52:00+00:00'
# save IODEF back to an XML file:
print iodef
open('iodef2_updated.xml', 'w').write(str(iodef))

API的更多信息

请参阅碘化物库文件夹中的iodeflib.html，或检查源代码中的docstrings。