StormLib++ Docs#
StormLib++ is a collection of Python code that make life as a Storm service developer easier paired with a collection of Synapse Rapid Power-Ups to make life as a Synapse analyst easier. See this blog post outlining it’s features.
StormLib++ is split into 2 parts:
A mono-Python module with many semi-related submodules - some are CLI tools, some are simply libraries, and some are both.
A collection of Synapse Rapid Power-Ups (Storm Packages).
The StormLib++ Python Package#
CLI Tools#
-
Recursively execute all Storm scripts in a folder (or folders) on a Synapse Cortex and import data from json/csv/text files.
python -m stormlibpp.tmpcortexStart a temporary Synapse Cortex for testing, data will not persist but it is an otherwise full featured Cortex.
-
A version of Synapse’s
synapse.tools.stormCLI that works over HTTPS instead of Telepath (Axon features aren’t supported).
-
A wrapper of Synapse’s
synapse.tools.feedscript that works over HTTPS instead of Telepath.
Python Objects#
-
A
storm:nodeStorm object in a Python runtime. It can be used to create, manipulate, or read Storm Nodes in Python.
-
A Python representation of a Storm package, proto and definition. This module makes the process of defining Storm Packages for Storm Advanced Power-Ups in Python easier. Rather than defining a Service’s Storm package in a Python dict, this object allows you to define a typical Rapid Power-Up in Yaml and
.stormfiles and attach it to a Storm Service API class.
stormlibpp.telepath.TelepathRetnThis object and it’s many defined subclasses can be used in a Storm Advanced Power-Up’s API to give developers a simple way to return standardized objects over Telepath (and it helps with type hints 🙂).
StormLib++ Power-Ups#
StormLib++ contains 4 different Synapse Rapid Power-Ups stored in the repo’s src/pkgs/ directory:
-
A Synapse Rapid Power-Up that brings DNS over HTTPS capabilities to a Cortex using Clourdflare.
-
Lookup common atomic indicators in Synapse as strings rather than a
<form>=<valu>pair.
-
A tool to download and model Threat Intel reports from the web.
-
An extension to the builtin stix Storm Library methods that rely on the StormLib++ project’s custom stix ingestion config.
Still a work in progress, see the repo’s stix branch.
See the pkgs page for more info.