<jupyter_start><jupyter_text>Simplest ExampleThe simplest thing you can generate is a single STIX object. Do this by specifying the object type name, capitalized and with spaces replaced by underscores. All statements must be terminated with a period.<jupyter_code>%%stix
Threat_Actor.<jupyter_output><empty_output><jupyter_text>In addition to STIX Domain Objects (SDOs), we can also generate STIX Cyber Observables (SCOs).<jupyter_code>%%stix
Domain_Name.<jupyter_output><empty_output><jupyter_text>RelationshipsYou can create relationships by giving the capitalized source object type, followed by the lowercase relationship type, followed by the target object type. If the relationship type has a space in it, replace it with a hyphen ("-").<jupyter_code>%%stix
Malware indicates Indicator.<jupyter_output><empty_output><jupyter_text>CountsYou can create multiple objects of the same type using a numeral before the object type name.<jupyter_code>%%stix
2 Domain_Name.<jupyter_output><empty_output><jupyter_text>To create multiple object types at once, you can use multiple statements, each terminated with a period.<jupyter_code>%%stix
Campaign. 2 Indicator.<jupyter_output><empty_output><jupyter_text>You can also generate multiple objects by surrounding them in parentheses:<jupyter_code>%%stix
(Campaign 2 Indicator).<jupyter_output><empty_output><jupyter_text>Relationships With CountsYou can create multiple relationships at once as well.<jupyter_code>%%stix
Attack_Pattern 2 uses Malware.
%%stix
Campaign targets (Identity Vulnerability).<jupyter_output><empty_output><jupyter_text>VariablesYou can give names to specific instances of objects by using a colon after the name, which must be lowercase. This lets you refer to them in other relationships, so the same object can be referenced multiple times.<jupyter_code>%%stix
sam: Threat_Actor.
sam uses Attack_Pattern.
sam attributed-to Identity.
(sam 2 Threat_Actor) uses Malware.<jupyter_output><empty_output><jupyter_text>Variables can refer to groups of objects as well. Note that the count goes before the variable name.<jupyter_code>%%stix
2 group: Indicator.
group indicates Malware.<jupyter_output><empty_output><jupyter_text>Specific Property ValuesYou can set properties to specific values by inserting a block of properties after the object type or variable. This block is surrounded by curly braces, and contains a property name followed by a colon and then the value for that property. Multiple properties are separated by commas.For example, to specify the name of an Identity instead of randomly generating a name:<jupyter_code>%%stix
Identity {name: "<NAME>"}.<jupyter_output><empty_output><jupyter_text>Here is an example specifying multiple properties:<jupyter_code>%%stix
Identity {name: "<NAME>", sectors: ["technology"]}.<jupyter_output><empty_output><jupyter_text>Special RelationshipsSome relationships constitute special cases that are handled slightly differently than other relationships. object_refsObjects that have an `object_refs` property, such as Report or Opinion, can populate this property using the "on" keyword.<jupyter_code>%%stix
Report on 3 Indicator.
%%stix
Opinion on (1 Campaign 2 Indicator).<jupyter_output><empty_output><jupyter_text>SightingsSimilarly, create sightings of objects using Sighting as the source object type and "of" as the relationship keyword.<jupyter_code>%%stix
Sighting of Indicator.<jupyter_output><empty_output><jupyter_text>Embedded RelationshipsEmbedded relationships can be set like any other property, using the curly brace syntax with multiple embedded relationships separated by commas.<jupyter_code>%%stix
Sighting {created_by_ref: Identity, observed_data_refs: Observed_Data} of Malware.<jupyter_output><empty_output><jupyter_text>ChainingObjects can also be used as both a source and a target of two different relationships, effectively "chaining" them together.<jupyter_code>%%stix
Campaign uses Malware targets Identity.<jupyter_output><empty_output><jupyter_text>As a point of comparison, here is how the same example could be written using variables. Note that using chaining keeps the input shorter and simpler.<jupyter_code>%%stix
mlwr: Malware.
Campaign uses mlwr.
mlwr targets Identity.<jupyter_output><empty_output><jupyter_text>ConfigurationThe generator has several options that can be configured by modifying the `config.ini` file in this directory. string_length_minRandomly generated strings can be no shorter than this many characters. string_length_maxRandomly generated strings can be no longer than this many characters. string_charsRandomly generated strings can only include these characters. number_minRandomly generated numbers must be higher than this number. is_number_min_exclusiveWhether randomly generated numbers can be equal to the `number_min` setting. number_maxRandomly generated numbers must be lower than this number. is_number_max_exclusiveWhether randomly generated numbers can be equal to the `number_max` setting. array_length_minRandomly generated array must contain at least this many items. array_length_maxRandomly generated array must contain at most this many items. optional_property_probabilityProbability, between 0 and 1, of generating optional properties in the objects. minimize_ref_propertiesIf True, the generator will only include `*_ref/s` properties if they are required properties, in an attempt to keep the generated graphs from ballooning in size.  Custom Objects and PropertiesThe generator is able to generate custom objects or custom properties on existing objects, but requires editing the `custom_registry.json` file located in this directory. This file is a mapping of object type names to a variety of options and a listing of the object's properties. By default we've added a custom property to the `User_Account` type and a custom object type called `Foobar`. You can view the specifications of all the predefined STIX 2.1 object types in `stix2generator/stix21_registry.json`. Here is what the default custom registry looks like:```json{    "Foobar": {        "type": "object",        "import": "common-properties",        "required": ["id", "some-property", "type"],        "properties": {            "type": "x-foobar",            "id": {                "type": "string",                "semantics": "stix-id",                "stix-type": "x-foobar"            },            "some-property": {                "type": "string",                "semantics": "word"            },            "another-property": {                "type": "string",                "semantics": "sentence"            }        }    },    "User_Account": {        "type": "object",        "required": ["id", "type", "all-props-group", "x_foo"],        "properties": {            "x_foo": {                "type": "string"            }        }    }}```Once we add a custom property to an existing object in the builder's registry, objects of that type will include that property.<jupyter_code>%%stix
User_Account.<jupyter_output><empty_output><jupyter_text>Once we've added a new object type to the builder's registry, we can generate objects of our custom type.<jupyter_code>%%stix
Foobar.<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.07277777777777777, 'fraction_numerical': 0.0022222222222222222, 'mean_word_length': 5.149444918872758, 'pattern_counts': {'":': 22, '<': 75, '<?xml version=': 0, '>': 75, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '18', 'dir': 'jupyter-structured-clean-dedup', 'id': '542064', 'license': 'BSD-3-Clause', 'n_tokens_mistral': 1964, 'n_tokens_neox': 1868, 'n_words': 775, 'path': 'examples.ipynb', 'repo_name': 'emmanvg/cti-stix-generator', 'size': '7210'}