Namespace not found importing US-Cert Stix
Rogueit opened this issue · 4 comments
I am trying to create a feed from the stix file posted on US-Certs site at
https://www.us-cert.gov/ncas/alerts/TA18-149A
when I run
python stix_to_feed.py -i TA18-149A.stix.xml -o TA18-149A.feed
i receive the following error message"
Traceback (most recent call last): File "stix_to_feed.py", line 231, in <module> bytes = create(options.input) File "stix_to_feed.py", line 206, in create reports = build_reports(input_source) File "stix_to_feed.py", line 188, in build_reports reports.append(build_report(input_source)) File "stix_to_feed.py", line 129, in build_report pkg = STIXPackage.from_xml(fname) File "C:\Python27\lib\site-packages\stix\core\stix_package.py", line 249, in from_xml return entity_parser.parse_xml(xml_file, encoding=encoding) File "C:\Python27\lib\site-packages\mixbox\parser.py", line 183, in parse_xml check_root=check_root File "C:\Python27\lib\site-packages\mixbox\parser.py", line 152, in parse_xml_to_obj entity_obj.build(root) File "C:\Python27\lib\site-packages\stix\bindings\stix_core.py", line 171, in build self.buildChildren(child, node, nodeName_) File "C:\Python27\lib\site-packages\stix\bindings\stix_core.py", line 203, in buildChildren obj_.build(child_) File "C:\Python27\lib\site-packages\stix\bindings\stix_core.py", line 572, in build self.buildChildren(child, node, nodeName_) File "C:\Python27\lib\site-packages\stix\bindings\stix_core.py", line 579, in buildChildren obj_.build(child_) File "C:\Python27\lib\site-packages\stix\bindings\indicator.py", line 1059, in build self.buildChildren(child, node, nodeName_) File "C:\Python27\lib\site-packages\stix\bindings\indicator.py", line 1081, in buildChildren obj_.build(child_) File "C:\Python27\lib\site-packages\stix\bindings\stix_common.py", line 3729, in build self.buildAttributes(node, node.attrib, already_processed) File "C:\Python27\lib\site-packages\stix\bindings\stix_common.py", line 3753, in buildAttributes prefix = lookup_name(typeinfo.ns) File "C:\Python27\lib\site-packages\mixbox\namespaces.py", line 859, in lookup_name return __ALL_NAMESPACES.preferred_prefix_for_namespace(ns_uri) File "C:\Python27\lib\site-packages\mixbox\namespaces.py", line 291, in preferred_prefix_for_namespace ni = self.__lookup_uri(ns_uri) File "C:\Python27\lib\site-packages\mixbox\namespaces.py", line 207, in __lookup_uri raise NamespaceNotFoundError(uri) mixbox.namespaces.NamespaceNotFoundError: Namespace not found: http://us-cert.gov/ciscp
Curious as to whether or not you found the answer for this.
If not, have you contacted NCCIC/US-CERT at nccicccustomerservice [at] us-cert.gov?
I have not found an answer nor contacted cert. I did open a support case with CB because my attempt and importing the iocs as a csv fails as well. I saw another thread where someone else had the same problem with a different flash.
I would need to take a look at the XML. Obviously that isn't something you want to share here, so feel free to contact us at dev-support@carbonblack.com. It looks like something is wrong with the namespace declaration in the STIX XML.
fixed with 12b91e1