Crate stix_matcher 

Match STIX 2.1 patterns against observed STIX objects.

Example

use stix_matcher::match_scos;
use stix_pattern::parse;
use stix_model::StixObject;

let pattern = parse("[ipv4-addr:value = '198.51.100.1']").unwrap();
let sco = StixObject::from_json(serde_json::json!({
    "type": "ipv4-addr", "id": "ipv4-addr--1", "value": "198.51.100.1"
})).unwrap();

let result = match_scos(&pattern, &[sco]).unwrap();
assert!(result.is_match());

Re-exports

pub use error::MatchError;

pub use observation::Observation;

pub use result::MatchResult;

Modules

compare

Scalar comparison between a resolved StixValue and a pattern Literal.

error

Error type for the matcher.

eval

Evaluation: leaf comparisons, comparison expressions, and observation expressions.

observation

An observation: a set of cyber-observable objects plus temporal metadata.

pattern_ops

The LIKE (SQL wildcard) and MATCHES (regex) operators.

resolve

Resolve a pattern ObjectPath to the set of values it selects on an object.

result

The outcome of a match.

subset

ISSUBSET / ISSUPERSET for IPv4/IPv6 addresses and CIDR ranges.

Functions

match_bundle

Match a pattern against a whole bundle, deriving observations from its observed-data SDOs and resolving references through the bundle’s objects.

match_observations

Match a pattern against a list of pre-built observations.

match_observed_data

Match a pattern against observed-data SDOs, resolving their object_refs through store (MITRE-compatible entry point).

match_scos

Match a pattern against a flat list of cyber-observable objects, treated as a single observation.