<commit_before>commonfields:
  id: StixCreator
  version: -1
name: StixCreator
script: |-
  ''' IMPORTS '''
  import json

  from stix2 import Indicator, Bundle

  indicators = []

  userArgs = demisto.args().get('indicators','Unknown')
  if isinstance(userArgs, dict) == True:
      all_args = json.loads(json.dumps(userArgs))
  else:
      all_args = json.loads(demisto.args().get('indicators','Unknown'))

  counter = 0
  for indicator_fields in all_args:
      demisto_indicator_type = all_args.get(str(counter)).get('indicator_type','Unknown')
      value = all_args.get(str(counter)).get('value','')
      source_system = all_args.get(str(counter)).get('source','')
      demisto_score = all_args.get(str(counter)).get('score','')
      first_seen = all_args.get(str(counter)).get('firstSeen','1970-01-01T00:00:00+00:00')
      demisto_created = all_args.get(str(counter)).get('timestamp','1970-01-01T00:00:00+00:00')
      last_seen = all_args.get(str(counter)).get('lastSeen','1970-01-01T00:00:00+00:00')
      counter+=1

      stix_type_and_value = ""

      if demisto_indicator_type.lower() == "File MD5".lower():
          stix_type_and_value = "[file:hashes.md5 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA-1".lower():
          stix_type_and_value = "[file:hashes.sha1 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA1".lower():
          stix_type_and_value = "[file:hashes.sha1 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA256".lower():
          stix_type_and_value = "[file:hashes.sha256 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA256".lower():
          stix_type_and_value = "[file:hashes.sha256 = '" + value + "']"
      elif demisto_indicator_type.lower() == "IP".lower():
          stix_type_and_value = "[ipv4-addr:value = '" + value + "']"
      elif demisto_indicator_type.lower() == "URL".lower():
          stix_type_and_value = "[url:value = '" + value + "']"
      else:
          stix_type_and_value = "[{}:value = '{}']".format(demisto_indicator_type.lower(),value)

      label_as_type = demisto_indicator_type.lower()

      if demisto_score.lower() == "bad":
          demisto_score = "High"
      elif demisto_score.lower() == "suspicious":
          demisto_score = "Medium"
      else:
          demisto_score = ""
      indicator = Indicator(labels=[label_as_type],
                            pattern=stix_type_and_value,
                            source=source_system,
                            created=demisto_created,
                            modified=last_seen,
                            firstSeen=first_seen,
                            score=demisto_score,
                            allow_custom=True)

      indicators.append(indicator)
  if counter > 1:
      bundle = Bundle(indicators)
      context = {
          'StixExportedIndicators': json.loads(str(bundle))
      }
      demisto.results({'Type': entryTypes['note'],
                       'Contents': str(bundle),
                       'EntryContext': context,
                       'ContentsFormat': formats['json']})
  else:

      context = {
          'StixExportedIndicators': json.loads(str(indicators[0]))
      }

      demisto.results({'Type': entryTypes['note'],
                       'Contents': str(indicators[0]),
                       'EntryContext': context,
                       'ContentsFormat': formats['json']})
type: python
tags: []
comment: Get list of indicators in argument 'indicators' and create out of them a
  json file in STIX 2.0 format
enabled: true
args:
- name: indicators
  description: json object of all indicators  fields index mapped to indicators fields
outputs:
- contextPath: StixExportedIndicators.created
  description: Indicator creation date
  type: string
- contextPath: StixExportedIndicators.firstSeen
  description: Indicator first appearance
  type: string
- contextPath: StixExportedIndicators.source
  description: Source system for this indicator
  type: string
- contextPath: StixExportedIndicators.type
  description: Indicator type
  type: string
- contextPath: StixExportedIndicators.pattern
  description: STIX pattern
  type: string
scripttarget: 0
runonce: false
dockerimage: demisto/stix2:1.0.0.1553427508
runas: DBotWeakRole
tests:
- StixCreator-Test
<commit_msg>rename test prefix from script to playbook<commit_after>commonfields:
  id: StixCreator
  version: -1
name: StixCreator
script: |-
  ''' IMPORTS '''
  import json

  from stix2 import Indicator, Bundle

  indicators = []

  userArgs = demisto.args().get('indicators','Unknown')
  if isinstance(userArgs, dict) == True:
      all_args = json.loads(json.dumps(userArgs))
  else:
      all_args = json.loads(demisto.args().get('indicators','Unknown'))

  counter = 0
  for indicator_fields in all_args:
      demisto_indicator_type = all_args.get(str(counter)).get('indicator_type','Unknown')
      value = all_args.get(str(counter)).get('value','')
      source_system = all_args.get(str(counter)).get('source','')
      demisto_score = all_args.get(str(counter)).get('score','')
      first_seen = all_args.get(str(counter)).get('firstSeen','1970-01-01T00:00:00+00:00')
      demisto_created = all_args.get(str(counter)).get('timestamp','1970-01-01T00:00:00+00:00')
      last_seen = all_args.get(str(counter)).get('lastSeen','1970-01-01T00:00:00+00:00')
      counter+=1

      stix_type_and_value = ""

      if demisto_indicator_type.lower() == "File MD5".lower():
          stix_type_and_value = "[file:hashes.md5 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA-1".lower():
          stix_type_and_value = "[file:hashes.sha1 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA1".lower():
          stix_type_and_value = "[file:hashes.sha1 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA256".lower():
          stix_type_and_value = "[file:hashes.sha256 = '" + value + "']"
      elif demisto_indicator_type.lower() == "File SHA256".lower():
          stix_type_and_value = "[file:hashes.sha256 = '" + value + "']"
      elif demisto_indicator_type.lower() == "IP".lower():
          stix_type_and_value = "[ipv4-addr:value = '" + value + "']"
      elif demisto_indicator_type.lower() == "URL".lower():
          stix_type_and_value = "[url:value = '" + value + "']"
      else:
          stix_type_and_value = "[{}:value = '{}']".format(demisto_indicator_type.lower(),value)

      label_as_type = demisto_indicator_type.lower()

      if demisto_score.lower() == "bad":
          demisto_score = "High"
      elif demisto_score.lower() == "suspicious":
          demisto_score = "Medium"
      else:
          demisto_score = ""
      indicator = Indicator(labels=[label_as_type],
                            pattern=stix_type_and_value,
                            source=source_system,
                            created=demisto_created,
                            modified=last_seen,
                            firstSeen=first_seen,
                            score=demisto_score,
                            allow_custom=True)

      indicators.append(indicator)
  if counter > 1:
      bundle = Bundle(indicators)
      context = {
          'StixExportedIndicators(val.pattern && val.pattern == obj.pattern)': json.loads(str(bundle))
      }
      demisto.results({'Type': entryTypes['note'],
                       'Contents': str(bundle),
                       'EntryContext': context,
                       'ContentsFormat': formats['json']})
  else:

      context = {
          'StixExportedIndicators(val.pattern && val.pattern == obj.pattern)': json.loads(str(indicators[0]))
      }

      demisto.results({'Type': entryTypes['note'],
                       'Contents': str(indicators[0]),
                       'EntryContext': context,
                       'ContentsFormat': formats['json']})
type: python
tags: []
comment: Get list of indicators in argument 'indicators' and create out of them a
  json file in STIX 2.0 format
enabled: true
args:
- name: indicators
  description: json object of all indicators  fields index mapped to indicators fields
outputs:
- contextPath: StixExportedIndicators.created
  description: Indicator creation date
  type: string
- contextPath: StixExportedIndicators.firstSeen
  description: Indicator first appearance
  type: string
- contextPath: StixExportedIndicators.source
  description: Source system for this indicator
  type: string
- contextPath: StixExportedIndicators.type
  description: Indicator type
  type: string
- contextPath: StixExportedIndicators.pattern
  description: STIX pattern
  type: string
- contextPath: StixExportedIndicators.score
  description: STIX impact score
  type: string
scripttarget: 0
runonce: false
dockerimage: demisto/stix2:1.0.0.1553427508
runas: DBotWeakRole
tests:
- StixCreator-Test

{'fraction_non_alphanumeric': 0.13169967550632203, 'fraction_numerical': 0.02170750811234195, 'mean_word_length': 2.8793402777777777, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3371773', 'n_tokens_mistral': 2910, 'n_tokens_neox': 2769, 'n_words': 506}