Convert data

Threatr

To convert data from or to Threatr format, use helper methods of ThreatrConverter:

threatr_to_colander() to convert to a Colander feed, it returns an object of type ColanderFeed
colander_to_threatr() to convert to a Threatr feed, it returns an object of type ThreatrFeed

Convert from Threatr feed to Colander feed

import json
from colander_data_converter.converters.threatr.converter import ThreatrConverter
from colander_data_converter.converters.threatr.models import ThreatrFeed

with open("path/to/threatr_feed.json", "r") as f:
    raw = json.load(f)
threatr_feed = ThreatrFeed.load(raw)
colander_feed = ThreatrConverter.threatr_to_colander(threatr_feed)

Convert from Colander feed to Threatr feed

import json
from colander_data_converter.base.models import ColanderFeed
from colander_data_converter.converters.threatr.converter import ThreatrConverter

with open("path/to/colander_feed.json", "r") as f:
    raw = json.load(f)
colander_feed = ColanderFeed.load(raw)
root_entity = colander_feed.entities.get("...uuid4...")
threatr_feed = ThreatrConverter.colander_to_threatr(colander_feed, root_entity)

MISP

To convert data from or to MISP format, use helper methods of MISPConverter:

misp_to_colander() to convert to a Colander feed, it returns a list of ColanderFeed
colander_to_misp() to convert to a MISP events, it returns a list of MISPEvent

Convert from MISP feed to Colander feed

from colander_data_converter.converters.misp.converter import MISPConverter
from pymisp import MISPFeed

misp_feed = MISPFeed()
with open("path/to/misp_feed.json", "r") as f:
    raw = f.read()
misp_feed.from_json(raw)
feeds = converter.misp_to_colander(misp_feed)

Convert from Colander feed to MISP events

import json
from colander_data_converter.base.models import ColanderFeed
from colander_data_converter.converters.misp.converter import MISPConverter

with open("path/to/colander_feed.json", "r") as f:
    raw = json.load(f)
colander_feed = ColanderFeed.load(raw)
misp_events = MISPConverter.colander_to_misp(colander_feed)

Stix2

To convert data from or to Stix2 format, use helper methods of Stix2Converter:

stix2_to_colander() to convert to a Colander feed, it returns an object of type ColanderFeed
colander_to_stix2() to convert to a Stix2 bundle, it returns an object of type Stix2Bundle

Convert from Stix2 bundle to Colander feed

import json
from colander_data_converter.converters.stix2.converter import Stix2Converter
from colander_data_converter.converters.stix2.models import Stix2Bundle

with open("path/to/stix2_bundle.json", "r") as f:
    raw = json.load(f)
stix2_bundle = Stix2Bundle.load(raw)
colander_feed = Stix2Converter.stix2_to_colander(stix2_bundle)

Convert from Colander feed to Stix2 bundle

import json
from colander_data_converter.base.models import ColanderFeed
from colander_data_converter.converters.stix2.converter import Stix2Converter

with open("path/to/colander_feed.json", "r") as f:
    raw = json.load(f)
colander_feed = ColanderFeed.load(raw)
stix2_bundle = Stix2Converter.colander_to_stix2(colander_feed)