@@ -381,10 +381,9 @@ def analyticsToDf(src):
381381 analytic_to_ds_map = {}
382382 for ds in detection_strategies :
383383 for analytic_id in ds .get ("x_mitre_analytic_refs" , []):
384- analytic_to_ds_map .setdefault (analytic_id , []).append ({
385- "detection_strategy_id" : ds ["id" ],
386- "detection_strategy_name" : ds .get ("name" , "" )
387- })
384+ analytic_to_ds_map .setdefault (analytic_id , []).append (
385+ {"detection_strategy_id" : ds ["id" ], "detection_strategy_name" : ds .get ("name" , "" )}
386+ )
388387
389388 for analytic in tqdm (analytics , desc = "parsing analytics" ):
390389 analytic_rows .append (parseBaseStix (analytic ))
@@ -395,33 +394,31 @@ def analyticsToDf(src):
395394 data_comp = src .get (data_comp_id )
396395 data_comp_name = data_comp .get ("name" , "" ) if data_comp else ""
397396
398- logsource_rows .append ({
399- "analytic_id" : analytic ["id" ],
400- "analytic_name" : analytic ["external_references" ][0 ]["external_id" ],
401- "data_component_id" : data_comp_id ,
402- "data_component_name" : data_comp_name ,
403- "log_source_name" : logsrc .get ("name" , "" ),
404- "channel" : logsrc .get ("channel" , "" )
405- })
397+ logsource_rows .append (
398+ {
399+ "analytic_id" : analytic ["id" ],
400+ "analytic_name" : analytic ["external_references" ][0 ]["external_id" ],
401+ "data_component_id" : data_comp_id ,
402+ "data_component_name" : data_comp_name ,
403+ "log_source_name" : logsrc .get ("name" , "" ),
404+ "channel" : logsrc .get ("channel" , "" ),
405+ }
406+ )
406407
407408 # detection strategies relationship table rows
408409 for ds_info in analytic_to_ds_map .get (analytic ["id" ], []):
409- analytic_to_ds_rows .append ({
410- "analytic_id" : analytic ["id" ],
411- "analytic_name" : analytic ["external_references" ][0 ]["external_id" ],
412- "detection_strategy_id" : ds_info ["detection_strategy_id" ],
413- "detection_strategy_name" : ds_info ["detection_strategy_name" ]
414- })
415-
416- dataframes ["analytics" ] = (
417- pd .DataFrame (analytic_rows ).sort_values ("name" )
418- )
419- dataframes ["analytic-logsource" ] = (
420- pd .DataFrame (logsource_rows )
421- )
422- dataframes ["analytic-detectionstrategy" ] = (
423- pd .DataFrame (analytic_to_ds_rows )
424- )
410+ analytic_to_ds_rows .append (
411+ {
412+ "analytic_id" : analytic ["id" ],
413+ "analytic_name" : analytic ["external_references" ][0 ]["external_id" ],
414+ "detection_strategy_id" : ds_info ["detection_strategy_id" ],
415+ "detection_strategy_name" : ds_info ["detection_strategy_name" ],
416+ }
417+ )
418+
419+ dataframes ["analytics" ] = pd .DataFrame (analytic_rows ).sort_values ("name" )
420+ dataframes ["analytic-logsource" ] = pd .DataFrame (logsource_rows )
421+ dataframes ["analytic-detectionstrategy" ] = pd .DataFrame (analytic_to_ds_rows )
425422
426423 citations = get_citations (analytics )
427424 if not citations .empty :
@@ -448,30 +445,26 @@ def detectionstrategiesToDf(src):
448445 rel_rows = []
449446 for detection_strategy in tqdm (detection_strategies , desc = "parsing detection strategies" ):
450447 row = parseBaseStix (detection_strategy )
451- row ["analytic_refs" ] = (
452- "; " .join (detection_strategy .get ("x_mitre_analytic_refs" , []))
453- )
448+ row ["analytic_refs" ] = "; " .join (detection_strategy .get ("x_mitre_analytic_refs" , []))
454449 detection_strategy_rows .append (row )
455450
456451 # analytics relationship table rows
457452 for analytic_id in detection_strategy .get ("x_mitre_analytic_refs" , []):
458453 analytic_obj = src .get (analytic_id )
459454
460- rel_rows .append ({
461- "detection_strategy_id" : detection_strategy ["id" ],
462- "detection_strategy_name" : detection_strategy .get ("name" , "" ),
463- "analytic_id" : analytic_id ,
464- "analytic_name" : analytic_obj ["external_references" ][0 ]["external_id" ],
465- })
455+ rel_rows .append (
456+ {
457+ "detection_strategy_id" : detection_strategy ["id" ],
458+ "detection_strategy_name" : detection_strategy .get ("name" , "" ),
459+ "analytic_id" : analytic_id ,
460+ "analytic_name" : analytic_obj ["external_references" ][0 ]["external_id" ],
461+ }
462+ )
466463
467464 # Build main dataframes
468- dataframes ["detectionstrategies" ] = (
469- pd .DataFrame (detection_strategy_rows ).sort_values ("name" )
470- )
465+ dataframes ["detectionstrategies" ] = pd .DataFrame (detection_strategy_rows ).sort_values ("name" )
471466
472- dataframes ["detectionstrategies-analytic" ] = (
473- pd .DataFrame (rel_rows )
474- )
467+ dataframes ["detectionstrategies-analytic" ] = pd .DataFrame (rel_rows )
475468
476469 citations = get_citations (detection_strategies )
477470 if not citations .empty :
@@ -1023,6 +1016,7 @@ def matricesToDf(src, domain):
10231016 # end adding of matrices
10241017 return matrices_parsed , sub_matrices_parsed
10251018
1019+
10261020def relationshipsToDf (src , relatedType = None ):
10271021 """Parse STIX relationships from the given data and return corresponding pandas dataframes.
10281022
0 commit comments