STIX Shifter Data Source Interface
STIX Shifter data source package provides access to data sources via stix-shifter.
Before use, need to install the target stix-shifter connector packages such as
stix-shifter-modules-carbonblack
.
The STIX Shifter interface can reach multiple data sources. The user needs to
setup one profile per data source. The profile name will be used in the
FROM
clause of the Kestrel GET
command, e.g., newvar = GET entity-type
FROM stixshifter://profilename WHERE ...
. Kestrel runtime will load the profile
for the used profile from environment variables:
STIXSHIFTER_PROFILENAME_CONNECTOR
: the STIX Shifter connector name, e.g.,elastic_ecs
.STIXSHIFTER_PROFILENAME_CONNECTION
: the STIX Shifter connection object in JSON string.STIXSHIFTER_PROFILENAME_CONFIG
: the STIX Shifter configuration object in JSON string.
Properties of profile name:
Not case sensitive, e.g.,
profileX
in the Kestrel command will matchSTIXSHIFTER_PROFILEX_...
in environment variables.Cannot contain
_
.
- class kestrel_datasource_stixshifter.interface.StixShifterInterface[source]
Bases:
kestrel.datasource.interface.AbstractDataSourceInterface