map-my-shifter

STIX-Shifter Connector's Mapping Builder

The map-my-shifter (MMS) project provides a visual way for building mapping files for STIX-Shifter project. A typical connector requires two types of fields mapping:

• From STIX pattern mapping - When building the data source query from STIX query, the STIX fields, for examples file:name, is mapped to the target data source's field. Read more...
• To STIX object mapping - When results object is back from the data source, this object should be displayed in the final results as STIX object. For examples {"filename": "xxxxx"} should be translated to STIX object of type file. Read more...

Use-cases

• Create mapping file from scratch.
• Load existing mapping file, edit the file and save it to a new file.

Demo

https://ibm.github.io/map-my-shifter/

Development

MMS is a static client side app, there is no backend involved, except from serving the static content. It is built with ReactJS library, and designed using Carbon Design System components.

Installation

• run npm install map-my-shifter
• import moduls: import {FromStix, ToStix} from 'map-my-shifter';

Usage

1. map-my-shifter component: react component that shows the STIX mapping
   • <FromStix.Mapping/>
   • <ToStix.Mapping/>
   • you can add property StixVersion with the value V_2_0 or V_2_1, defult is V_2_0.
   • for example: <FromStix.Mapping StixVersion='V_2_1'/>

2. map-my-shifter import function: gets a javaScript object and adds the content to the mapping
   • FromStix.Import(JSON.parse({"ipv4-addr": {"fields": {"value": ["sourceip"]}}}))
   • ToStix.Import(JSON.parse({"ipv4-addr": {"fields": {"value": ["sourceip"]}}}))

3. map-my-shifter export function: gets a string and opens a window to save the mapping to a file.
   • FromStix.Export('fileName')
   • ToStix.Export('fileName')

Authors

• Bar Haim
• Ido Hersko
• Noaa Kless

Licensing

map-my-shifter is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Built with ❤️ from IBM Cyber Security Center of Excellence (CCoE)