map-my-shifter

STIX-Shifter Connector's Mapping Builder

The map-my-shifter (MMS) project provides a visual editor for building mappings for STIX-Shifter modules. A typical (module) connector requires two types of field mappings:

• From STIX pattern mapping - When building the data source query from a STIX query, the STIX fields, for example file:name, is mapped to the target data source's field. Read more...
• To STIX object mapping - When a results object is back from the data source, this object gets translated in the final result as a STIX object. For example {"filename": "xxxxx"} should be translated to a STIX object of type file. Read more...

Demo Online Editor

https://ibm.github.io/map-my-shifter/

Use-cases

• If you just want to use the editor - you can use the online version to:
  • Create a new mapping file from scratch, for a new stix shifter module.
  • Load an existing mapping file, edit the file and save it to a new file.
• You can run the editor locally on your machine:
  • clone the repo
  • cd into your cloned repo
  • run npm install
  • run npm start TODO: is this correct?
• You can run the editor inside a Docker container:
  • TODO: add instructions and support for docker
• You can embed this editor as a React component in your own React Carbon app

Development

MMS is a static client side app, there is no backend involved, except from serving the static content. It is built with the ReactJS library, and designed using Carbon Design System components.

Usage as a React Component

If you would like to use the editor with your own use case, such as a client app running in an electron framework, or embedding it into your own web app you can utilize it as a React component and wrap it with your own code. However, your web app must utilize the Carbon design system.

instructions for utiliziation as a React Component

• run npm install map-my-shifter
• import modules: import {FromStix, ToStix} from 'map-my-shifter';

Now you can use:

1. map-my-shifter component: a react component that displays the STIX mappings
   • <FromStix.Mapping/>
   • <ToStix.Mapping/>
   • you can add a property StixVersion with the value V_2_0 or V_2_1, defult is V_2_0.
   • for example: <FromStix.Mapping StixVersion='V_2_1'/>

2. map-my-shifter import function: gets a javaScript object and adds the content to the mapping
   • FromStix.Import(JSON.parse({"ipv4-addr": {"fields": {"value": ["sourceip"]}}}))
   • ToStix.Import(JSON.parse({"ipv4-addr": {"fields": {"value": ["sourceip"]}}}))

3. map-my-shifter export function: gets a string and opens a window to save the mapping to a file.
   • FromStix.Export('fileName')
   • ToStix.Export('fileName')

Authors

• Bar Haim
• Ido Hersko
• Noaa Kless

Licensing

map-my-shifter is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Built with ❤️ from IBM Cyber Security Center of Excellence (CCoE)