Crate stix 

Umbrella crate for the stix-rust toolkit.

Re-exports the parser (pattern), object model (model), and matcher (matcher) so downstream code can depend on a single crate.

Example

use stix::parse;
use stix::matcher::match_scos;
use stix::model::StixObject;

let pattern = parse("[ipv4-addr:value = '198.51.100.1']").unwrap();
let sco = StixObject::from_json(serde_json::json!({
    "type": "ipv4-addr", "id": "ipv4-addr--1", "value": "198.51.100.1"
})).unwrap();
assert!(match_scos(&pattern, &[sco]).unwrap().is_match());

Re-exports

pub use stix_matcher as matcher;

pub use stix_model as model;

pub use stix_pattern as pattern;

Functions

match_bundle

The high-level matching entry points. Match a pattern against a whole bundle, deriving observations from its observed-data SDOs and resolving references through the bundle’s objects.

match_observations

The high-level matching entry points. Match a pattern against a list of pre-built observations.

match_observed_data

The high-level matching entry points. Match a pattern against observed-data SDOs, resolving their object_refs through store (MITRE-compatible entry point).

match_scos

The high-level matching entry points. Match a pattern against a flat list of cyber-observable objects, treated as a single observation.

parse

Parse a STIX pattern string into an AST (re-export of stix_pattern::parse). Parse a complete pattern string into an AST.